Security

Your data stays
where you put it.

Including the AI. Document extraction and matter questions are processed in the same AWS region as the files themselves, rather than being sent somewhere else and returned.

Encrypted at rest and in transit Australian data residency Hosted on AWS No lock-in contracts Guided setup available Your data exportable on request

Last reviewed

Where does MatterFirst store an Australian law firm's data?

In the AWS region your firm chooses, with Sydney (ap-southeast-2) the default for Australian firms. Matter data, documents and Document AI processing all stay in that region: files are not moved elsewhere to be OCRed, extracted or answered against.

Where each kind of processing happens
What Where it runs Notes
Matter data and documents Your chosen AWS region Sydney (ap-southeast-2) by default for Australian firms
Document AI extraction Your chosen AWS region Files are not copied to another region to be processed
Matter questions to the AI assistant Your chosen AWS region Inference runs in-region, answering from your own documents
Backups Your chosen AWS region Held in the same region as the primary data
Email and calendar content Your provider Microsoft 365 or Google Workspace hold their own copies under your tenancy
Payments Stripe Card details go to Stripe directly and are never stored by MatterFirst

Ask any vendor where inference runs, not only where files are stored. They are frequently different regions, and the second question is the one that is usually left unanswered.

How access works

Who can see what, and how you can tell.

Role-based permissions

Access is granted by role rather than per user, so a person's access changes when their role does instead of being maintained by hand.

Matter-level audit trail

Changes to a matter record what happened and who did it, which is the trail an external examiner or a complaint asks for.

Privileged document handling

Documents can be marked privileged and excluded from the client portal, so portal visibility is a deliberate act rather than a default.

Single sign-on

Authentication runs through your identity provider, so leavers lose access when their account is disabled rather than when someone remembers.

Automation run log

Every automation records what fired and why, so an unexpected email to a client can be traced to the rule that sent it.

Export on request

Matters, contacts, documents and time records are exportable. We would rather you were able to leave and chose not to.

How to check this

Test it rather than take our word for it.

Everything on this page is architectural, which means you can verify it during a trial rather than accepting it as a claim. Pick your region and confirm where the data lands. Upload a document, run extraction, and ask us to show you where it was processed. Change something on a matter and read the audit log back.

We will also answer any of it in writing for your IT adviser. If there is a question this page does not cover, the evaluation checklist has the full list worth putting to us, and to every other vendor you are considering.

Open the evaluation checklist

FAQ

Questions firms ask about security

Where is my firm's data stored?
In the AWS region your firm chooses. Sydney (ap-southeast-2) is the default for Australian firms. Matter data, documents and Document AI processing all stay in that region.
Does AI processing send my documents overseas?
No. Document extraction and matter questions are processed inside the same AWS region as the documents. This is worth asking every vendor separately from where files are stored, because the two answers are often different.
Is MatterFirst SOC 2 or ISO 27001 certified?
No. We do not hold either. The controls described on this page are architectural and you can test them in a trial, but they are not a third-party audit and we will not present them as one.
Can I get my data out if I leave?
Yes. Matters, contacts, documents and time records are exportable on request, and there is no lock-in contract.
Who can see our matters inside MatterFirst?
Access is role-based within your workspace, and documents can be marked privileged to keep them out of the client portal. Changes to a matter are recorded with who made them.
Where is my data stored?
In the AWS region your firm chooses. Sydney (ap-southeast-2) is the default for Australian firms. Matter data, documents and Document AI processing all stay in that region: documents are not moved to another region to be OCRed or analysed.
How much does MatterFirst cost?
Pricing is per workspace rather than per seat, starting at $149 per month for Solo. Each plan includes a set number of users, a monthly pool of Document AI credits, the client portal and automations. Extra users are billed only past the included seats. Full plan inclusions are on the pricing page.
Is there a free trial?
Yes, a seven-day guided trial on Solo, Practice or Firm. It is guided rather than self-serve because a practice management system tells you very little until it has your real matters in it, and we would rather help you load them than leave you looking at an empty workspace.
Who builds MatterFirst?
NorthCape Technology, a Melbourne-based software company. MatterFirst is built in Australia for Australian legal practice, which is why trust accounting and Xero are first-class rather than regional add-ons, and why PEXA and InfoTrack are on the roadmap rather than absent from it.
Is MatterFirst suitable for a firm of my size?
It is designed for solo practitioners up to firms of roughly twenty seats. Below that, Solo carries the full platform for one user. Above it, the platform works but you should expect to talk to us about migration and rollout rather than signing up online.

MatterFirst is a legal practice management platform for Australian law firms, built by NorthCape Technology, covering matters, documents, trust accounting, billing and a client portal, with data hosted in the AWS region the firm chooses.

This page suits a firm doing due diligence on where its client data will live, and on whether AI processing stays in the same place as the files. A firm whose procurement process turns on completed third-party audit reports should ask us about that directly, because the answer is in the FAQ below rather than on a badge.

Want the technical detail?

Happy to walk your IT adviser or practice manager through the architecture, and to answer the questions this page does not.

Book a demo Talk to us