Security at Matter Due

Law firms need confidence that their operational data is handled responsibly. Matter Due is designed with access control, privacy and firm-level data separation at its core.

Hosted in the UKWith nightly encrypted backups.
Each firm kept separateEnforced by the database itself.
EncryptedIn transit, with sensitive credentials also encrypted at rest.
Staff access recordedTwo-factor protected, with every action logged.
Your data is yoursExport it any time; deleted when you leave.

The details

Data protection

  • All traffic to Matter Due, including the office board, is encrypted over HTTPS.
  • Login details for connected services, such as your firm's SMS and WhatsApp account, are encrypted at rest, with the keys held separately from the data they protect.
  • Passwords are stored only as salted one-way hashes. We can check a password you type; we can't look one up.
  • Payments are handled by Stripe. Card details are entered on Stripe's own checkout and never reach Matter Due.

Access control

Your firm decides who can do what. Everyone signs in with their own account, and each person has a role — Owner, Admin or Member. Access to reports, screens and team management can be switched on person by person. Billing, data export and closing the account stay with the owner, and deleting an account needs a one-time code sent to the owner's email.

Firm data separation

No firm using Matter Due can see another firm's data. That separation is enforced by the database itself, not only by the application — every request is limited to the records of the firm it belongs to.

Privacy

  • Reminders go only to your own staff. Matter Due never contacts your clients.
  • Each office screen has its own display mode. A screen in Private mode never receives client names, so they can't be seen on it or retrieved from the device.
  • We don't sell your data or use it for third-party advertising.

Auditability

Our support staff can only reach a firm's account through two-factor login, and every action they take is recorded with who did it and when. Within your firm, reminder history records what was sent, to whom and when, and can be downloaded as a spreadsheet.

Infrastructure

Matter Due is hosted on servers in the United Kingdom. The database is backed up nightly, the backups are encrypted, and restoring from them has been tested.

Sub-processors

We use a small number of sub-processors: Stripe (payments), Brevo (email delivery), Twilio (SMS and WhatsApp — under your firm's own account), our hosting provider, and error monitoring. The current list, with purpose and location, is in the Privacy Policy.

Your data, your control

  • Export — your matters, deadlines and reminder history can be downloaded as a spreadsheet at any time.
  • Deletion — when your account is closed, your firm's data is permanently deleted from the live system; any copy in a backup expires as part of the normal backup cycle.

More detail for due diligence

If your firm needs more than this page covers — for a supplier questionnaire or a compliance review — get in touch and we'll share further security documentation with you directly.

Reporting a vulnerability

Email support@matterdue.co.uk. We'll acknowledge it within a few working days and keep you updated on the fix.

See also the Privacy Policy and the data processing terms in the Terms of Service.

Questions before you sign up?

We're happy to talk through how Matter Due handles your firm's data.

Try Matter Due free for 14 days Talk to us