Security

How we protect your files

Last updated 23 September 2026

A law chamber's papers are privileged. We built Ruvara on the assumption that someone will one day try to read them without permission, and we designed every layer to make that fail.

In transit

• Every page and every file is served over HTTPS with certificates renewed automatically. Browsers are told never to connect over plain HTTP again (HSTS).
• Pages cannot be framed by other websites, and the browser is told not to guess file types.

Signing in

• Two-factor authentication for every account, using any standard authenticator app, with single-use recovery codes.
• Passwords of at least twelve characters, checked against a list of common and easily guessed passwords. Passwords are stored only as salted bcrypt hashes; nobody at Ruvara can read them.
• Repeated wrong attempts are slowed down per account and per network. A wrong email and a wrong password produce the same answer in the same time, so the sign-in page cannot be used to discover who has an account.
• Sessions are held in secure, HTTP-only cookies that page scripts cannot read.

Where your files live

• On servers in the Amazon Web Services Mumbai region, in India.
• On disks encrypted at rest. An automatic snapshot of the whole disk is taken every day and kept for two weeks.
• The server has no remote login port open to the internet at all. Administration happens through Amazon's audited management channel, not a password prompt.

Inside the chamber

• Roles for partners, associates, clerks and interns, each limited to what the role needs.
• An audit trail of sign-ins, uploads and changes, with who did it and when.

Reporting a problem

If you believe you have found a security weakness, please write to us with the details. We will acknowledge it promptly and ask that you give us a reasonable time to fix it before telling anyone else.