Security

Security you can verify

HOAShark is built to hold privileged legal work. Here is exactly how it is protected, who processes your data, and tests you can run yourself.

Check it yourself

Independent tests, run live

These free public scanners test hoashark.com from the outside. Each link runs the test now, so the result is current rather than a badge we chose to display.

Qualys SSL LabsEncryption of the connection to our site
Run the test →securityheaders.comBrowser protections our pages send
Run the test →Mozilla HTTP ObservatoryOverall web security configuration
Run the test →
How your matter is protected

Built for privileged work

HOAShark holds association records, exhibits and attorney work product. These are the controls in place today.

No passwords to stealYou sign in with a one-time code sent to your email. We never create or store a password for you.
Checked twice, every timeCloudflare Access screens each visit before it reaches HOAShark, and HOAShark then verifies the signed sign-in token on every request.
Each matter is sealed offA user sees only the matters they have been given. Requests for any other matter are answered as if it did not exist.
Encrypted in transit and at restConnections require TLS 1.2 or newer. The database and file storage are encrypted at rest with AES-256, per our hosting provider.
Exhibits are fingerprintedEvery file is stored unchanged with its SHA-256 fingerprint, so anyone can confirm a copy matches the original.
Nothing quietly disappearsExhibits, counsel drafts, research-assistant answers and the activity log cannot be deleted through the application. Counsel drafts and the log cannot be rewritten either: an edit to a draft is saved as a new version.
Every action is loggedEvery visit by invited users, every change, every file download, and every time HOAShark staff open a matter are recorded with the time and the account.
Privileged work stays out of AIThe Counsel workspace is visible only to the matter owner and invited counsel and is never sent to the research assistant.
Point-in-time recoveryThe database can be restored to any minute within the last 30 days.
The research assistant

What the AI sees, and what it doesn't

Sent to the AI provider

  • Your question
  • The exhibit text, findings and timeline it opens to answer, from the matter you are in

Never sent

  • The Counsel workspace: briefs, notes and drafts
  • Any other matter
  • Anything at all if you don't use Ask; every other feature works without it

The assistant runs on Anthropic's commercial API. Anthropic's published terms for that service say customer content is not used to train its models without the customer's permission. The assistant cites the exhibit behind each statement and never files, sends or signs anything.

Where data lives

Who processes your data

We use a short list of established providers. Each holds its own security certifications for its own services; follow the links to review them.

ProviderWhat it does for HOASharkLocation
CloudflareHosting, sign-in screening, database and file storageUnited States (Eastern North America)
AnthropicThe optional research assistant (Ask) and the support chat on this siteUnited States
Google WorkspaceEmail to and from hoashark.com addressesUnited States

Public-records searches (court cases, liens, recorded documents and corporate filings) run through a licensed, read-only records service under common ownership with HOAShark. It receives the search terms, the matter reference and the user's email for its access log. It never receives documents or case files.

For attorneys and firms

Doing vendor due diligence?

Florida Bar Ethics Opinion 24-1 asks lawyers to confirm how a technology vendor protects client confidences. Our due-diligence packet answers those questions in writing: confidentiality, breach and legal-demand notice, retention, AI training and subprocessors.

Request the packet

HOAShark itself has not yet completed an independent SOC 2 audit. Our providers' certifications cover their services, not ours, and we don't display badges we haven't earned. When we complete an independent audit, the report will be listed here.

Report a problem

Found a security issue?

Email support@hoashark.com with what you found and how to reproduce it. Please give us a reasonable chance to fix it before sharing it publicly, and don't access other people's data while testing. We reply to every good-faith report. Our security.txt follows RFC 9116.