Security

Where your information goes,
and the controls that protect it.

The application and your documents are in Sydney, and the AI answers matter questions in Australia. Reading a document runs in Azure's Australia East region. The table below names the services and scope of these locations.

Encrypted in transit Documents and AI in Australia No lock-in contracts Guided setup available Your data exportable on request

Last reviewed

Where does MatterFirst store an Australian law firm's data?

The application runs on Fly.io in Sydney. Database and backups are hosted on Fly.io Managed high-availability PostgreSQL clusters in Sydney. Documents are stored in Amazon Web Services S3 in Sydney. Document extraction and matter questions run on Amazon Web Services Bedrock in Australia, and reading a scanned document runs in Microsoft Azure's Australia East region. These locations describe the application, document storage, database, backups and document AI services. The trust evidence page at /trust records the scope and dated evidence for each published control.

Where each kind of processing happens
What Where it runs Notes
The application Fly.io, Sydney The servers that run MatterFirst
Database and backups Fly.io Managed PostgreSQL, Sydney Database and backups are hosted on Fly.io Managed high-availability PostgreSQL clusters in Sydney.
Documents AWS, Sydney Amazon Web Services S3 in Sydney (ap-southeast-2)
Document AI: reading the document Azure Australia East The OCR and layout step runs on Azure AI Document Intelligence, not in your AWS region. Both regions are in Australia
Document AI: analysing what was read AWS, Australia Extraction and analysis run on AWS Bedrock with Australian routing
Matter questions to the AI assistant AWS, Australia Answers come from AWS Bedrock with Australian routing, from your own documents
Email and calendar content Your provider, and MatterFirst Microsoft 365 or Google Workspace keep the originals; an email filed to a matter is copied into MatterFirst
Emails MatterFirst sends: reminders and notifications Resend Reminder and notification delivery through Resend
Error reports Sentry, when switched on Error reporting through Sentry when enabled; this row makes no regional storage claim
Payments Stripe Card details go to Stripe directly and are never stored by MatterFirst

Ask any vendor where inference runs, not only where files are stored. They are frequently different regions, and the second question is the one that is usually left unanswered.

How access works

Who can see what, and how you can tell.

Role-based permissions

Access is granted by role rather than per user, so a person's access changes when their role does instead of being maintained by hand.

Matter-level audit trail

Changes to a matter record what happened and who did it, which is the trail an external examiner or a complaint asks for.

Privileged document handling

Documents can be marked privileged and excluded from the client portal, so portal visibility is a deliberate act rather than a default.

Central account control

Authentication runs through a central identity service rather than per-app passwords, so deactivating a leaver's account ends their access everywhere at once. Federating your own identity provider is not supported yet.

Automation run log

Every automation records what fired and why, so an unexpected email to a client can be traced to the rule that sent it.

Export on request

Matters, contacts, documents and time records are exportable. We would rather you were able to leave and chose not to.

How to check this

Test it rather than take our word for it.

Everything on this page is architectural, which means you can verify it during a trial rather than accepting it as a claim. Upload a document, run extraction, and ask us to show you where it was processed. Change something on a matter and read the audit log back.

We will also answer any of it in writing for your IT adviser. If there is a question this page does not cover, the evaluation checklist has the full list worth putting to us, and to every other vendor you are considering.

The controls described on this page are listed with their evidence and the date it was last checked on the trust evidence page.

Read the dated evidence Open the evaluation checklist

FAQ

Questions firms ask about security

Where is my data stored?
The application runs on Fly.io in Sydney. Database and backups are hosted on Fly.io Managed high-availability PostgreSQL clusters in Sydney. Documents are stored in Amazon Web Services S3 in Sydney. Document extraction and matter questions run on Amazon Web Services Bedrock in Australia, and reading a scanned document runs in Microsoft Azure's Australia East region. These locations describe the application, document storage, database, backups and document AI services. The trust evidence page at /trust records the scope and dated evidence for each published control.
Does AI processing send my documents overseas?
Not by design. Document extraction and matter questions are set to run in Amazon Web Services' Sydney region, and reading the document runs in Azure's Australia East region. The trust evidence page records which of these settings has been confirmed on the live service, and when. This is worth asking every vendor separately from where files are stored, because the two answers are often different.
Is MatterFirst SOC 2 or ISO 27001 certified?
No. We do not hold either. The controls described on this page are architectural and you can test them in a trial, but they are not a third-party audit and we will not present them as one.
Can I get my data out if I leave?
Yes. Matters, contacts, documents and time records are exportable on request, and there is no lock-in contract.
Who can see our matters inside MatterFirst?
Access is role-based within your workspace, and documents can be marked privileged to keep them out of the client portal. Changes to a matter are recorded with who made them.
How much does MatterFirst cost?
Pricing is per workspace rather than per seat, starting at $199 per month for Solo. Each plan includes a set number of users, a monthly AI balance in Australian dollars, the client portal and automations. Extra users are billed only past the included seats. Full plan inclusions are on the pricing page.
Is there a free trial?
Yes, a 14 day guided trial on Solo, Practice or Firm. It is guided rather than self-serve because a practice management system tells you very little until it has your real matters in it, and we would rather help you load them than leave you looking at an empty workspace.
Who builds MatterFirst?
NorthCape Technology, a Melbourne-based software company. MatterFirst is built in Australia for Australian legal practice, with trust accounting and Xero as first-class capabilities. Available through coordinated setup: PEXA, InfoTrack. Coordinated manual setup is arranged with MatterFirst and the provider.
Is MatterFirst suitable for a firm of my size?
It is designed for solo practitioners up to firms of roughly twenty seats. Below that, Solo carries the full platform for one user. Above it, the platform works but you should expect to talk to us about migration and rollout rather than signing up online.

MatterFirst is an AI-native legal practice management platform for Australian law firms, built for small and boutique practices by NorthCape Technology.

This page suits a firm doing due diligence on where its information goes, and on whether AI processing happens in the same country as its documents. A firm whose procurement process turns on completed third-party audit reports should ask us about that directly, because the answer is in the FAQ below rather than on a badge.

Want the technical detail?

Happy to walk your IT adviser or practice manager through the architecture, and to answer the questions this page does not.

Book a demo Talk to us