Security and data protection
Your clients trust you. Tarikh has to earn yours.
A chamber's register is its most sensitive record: who the clients are, what they are accused of, what they owe. Here is exactly what we do to protect it, in plain language and without certifications we do not hold.
Our commitments
Five pledges we hold ourselves to
Security before features
A control that protects the register ships before a feature that decorates it. Access checks and org scoping are reviewed on every change.
Least access, always
Members see only their chamber, staff see production only to operate it, and every path to data is logged with a name on it.
Plain language, no badges
We describe what is running today. We say "designed to meet" and "we follow", never a certification we do not hold.
Your data stays yours
Export in CSV or PDF at any time, delete on request, and no use of chamber data for training, marketing or resale.
Tell you quickly
If an incident touches your chamber, you hear it from us first, with what happened, what was affected and what we did.
What is built
Nine controls, stated plainly
One chamber, one tenant
Every case, hearing, client and payment row carries the chamber it belongs to, and every query is scoped by it. A member of one chamber cannot read, list or search another chamber's data. This is enforced in the database layer, not just in the screens.
Role-based permissions
Seniors govern: they invite and remove members and delete cases. Juniors and clerks have full day-to-day rights to enter, edit and update cases and send SMS. Nobody gets more than their role needs.
httpOnly cookie sessions
Sign-in creates a signed session stored in an httpOnly, secure cookie that page scripts cannot read. Sessions are short-lived and are rotated when you sign in from a new device.
Encrypted in transit
Everything between your phone or laptop and Tarikh travels over TLS, so a public court Wi-Fi network cannot read your diary. Sessions are signed and short-lived.
Backed-up, encrypted database
Chamber data lives in an encrypted managed database with automated backups, encrypted at rest, so a hardware fault does not become a lost register. We will publish provider and region details before general availability.
Never used to train AI
Your cases, clients, notes and Clause questions are not used to train or fine-tune any AI model, ours or a vendor's. Clause reads the law and the judgments, not your register.
Clause threads purged after 7 days
Each Clause conversation is private to the member who started it and is deleted automatically after 7 days of inactivity. Research does not linger.
SMS through a Bangladeshi gateway
Client SMS is sent through a Bangladeshi SMS gateway over a private connection, using only the client's number and the message you approve. Numbers are not shared with anyone else.
Export or delete at any time
Export every case to CSV, export any case as a PDF, and ask us to delete the chamber when you no longer need it. The data is yours, not ours.
Architecture at a glance
What crosses each boundary
Tarikh is a small system on purpose. Every arrow below is a boundary, and next to each one is the only data that is allowed across it.
- Phone or desktop
Browser or the Tarikh app. Session lives in an httpOnly cookie.
- HTTPS (TLS)
Every request encrypted in transit. No plain HTTP is served.
- Application servers
Checks the session, resolves the chamber, applies role permissions.
- Encrypted database
Every row carries its chamber. Queries are scoped by org, so one chamber never reads another.
org-scoped rows
- SMS gateway
Crosses: client number and the message you approved. Nothing else.
- AI model provider
Crosses: your question and the law or judgment passages. Never your cases, clients or register.
no training
What we never do
What we never do
Four lines we will not cross, whatever the plan or the price.
- Sell, rent or trade chamber data to anyone.
- Train or fine-tune AI models on your cases, clients or Clause questions.
- Share one chamber's data with another chamber, even within the same building.
- Keep a Clause thread past 7 days of inactivity.
Data lifecycle
What happens to a record from the day it is entered to the day it is gone.
- 01
Create
A case, hearing, client or payment is entered by a member. It is stamped with the chamber, the author and the time.
Kept while the chamber account exists
- 02
In use
Read and edited only by members of that chamber, under their role. Every edit is appended to the case history.
Clause threads: deleted after 7 days idle
- 03
Export
Any member can export all cases to CSV or one case to PDF. Files are generated when requested, not stored for you.
Exports on demand, any time
- 04
Delete
A Senior deletes a case, or asks us to delete the chamber. Live rows are removed; backup copies age out on the backup schedule.
Live data removed on request
Every change has a name on it
Every hearing, note, case edit and payment records who made it and when. When a client asks why a tarikh moved, or two chamber-mates disagree about who entered what, the answer is in the case history, not in anyone's memory.
Deleting a case is a Senior-only action. Everything else is an edit that leaves a trail, which is the same discipline a well-kept paper register enforces, now without the ink.
What we do not claim
We are a small team and we do not hold ISO 27001, SOC 2 or similar certifications today. What you read above is what is built and running. If your chamber or a corporate client needs a specific assurance, write to us and we will answer directly rather than point you to a badge.
Write to usResponsible disclosure
Found a weakness? Tell us first.
We welcome reports from security researchers and from chambers. Write to the security inbox with the steps to reproduce, the affected URL and what you observed.
What we promise
- Acknowledgement within 2 business days.
- A named engineer as your contact until it is fixed.
- A fix timeline once we have confirmed the issue, and a note when it ships.
- Credit on this page if you want it.
PGP key available on request from the same address.
Safe harbour
If you research in good faith, avoid reading or altering data that is not yours, do not disrupt the service and give us reasonable time to fix, we will not pursue legal action against you and we will treat the report as authorised.
We do not run a paid bounty programme today. We say so up front rather than imply one.
Sub-processors
The services that touch chamber data on our behalf, and why. Region is as configured by the deployment and is stated in your DPA.
| Service | Purpose | Region |
|---|---|---|
| Cloud hosting | Runs the application on a private network with HTTPS at the edge | As configured by the deployment |
| Managed database | Primary database with encrypted automated backups | As configured by the deployment |
| SMS gateway (Bangladesh) | Delivers client SMS; receives only the number and the approved message | As configured by the deployment |
| AI model provider | Clause legal research answers under a no-training agreement | As configured by the deployment |
| Queue and cache service | Rate limiting, queues and scheduled jobs such as the morning digest | As configured by the deployment |
| Error monitoring | Error reporting with personal data scrubbed | As configured by the deployment |
This list changes only when we add or remove a service, and this page is updated first.
Legal
The policies behind this page, and where to ask for a data processing agreement.
Security questions chambers ask
Can Tarikh staff read my cases?
Access to production data is limited to a small number of engineers, for operating the service and for support you have asked for. We do not browse chamber data, and we never use it for marketing or AI training.
What happens to my data if I stop paying?
Your chamber stays readable so you can export everything. Nothing is deleted just because a term lapsed. When you ask us to delete the chamber, the cases, clients, payments and attachments are removed.
Where is the data hosted?
With reputable cloud infrastructure providers, encrypted in transit and backed up with encryption at rest. We will publish provider and region details before general availability, and this page will be updated when that happens.
Do you send client numbers to any third party?
Only to the SMS gateway for the messages you choose to send, and only the number and message text. WhatsApp messages open in your own WhatsApp, so nothing passes through us at all.
Your chamber, one screen.
The Bangla-first diary for law chambers, now with AI legal research. Free for 14 days. No payment needed.