Privacy Policy

Financial Records, Kept Only as Planned

Plaid, the data broker, retrieves authorized records under agreements with the financial institutions that issued them, and holds the access an invitee grants. Civil Rule 26 never sees or stores an invitee's banking username or password.

When an invitee links an institution, we retrieve the records the attorney ordered (balances, transactions and statements) and keep them on our own servers, the statements encrypted, for the attorney to download. Each institution stays connected, its records kept up to date, until the end of the calendar month it is linked in, or for the months the attorney ordered, and is then disconnected, so no connection is left open. The records are deleted on the date the attorney set when ordering, at most a year after they arrive, or sooner if the invitee deletes their data. We never copy them into our backups, so once deleted they are gone.

Information We Collect

• From attorneys. The name and bar number for every jurisdiction you list at signup. We first try to verify each license automatically against official bar records: Washington licenses in the Washington State Bar Association's Legal Directory, and other states' through Data & APIs, a service that searches state bar directories. When that works we pull your email, phone, and firm directly from that record rather than a form you fill in. If the automatic check can't confirm you, we ask you for your email, phone, firm, and website, and anything else you'd like us to know, and keep them with your request while we check your bar record by hand.
• Attorney signup records. We keep a record of every attempt to sign up as an attorney, whether or not it succeeds: when it was made, the name, email, and bar numbers entered, the IP address it came from, what the bar records showed for each bar number, and what came of it. We use these records to verify attorneys, to prevent misuse of bar numbers (each can be used to sign up only once), and to answer questions about your account.
• From invitees. The email and name the requesting attorney provides to send your invite, the passkey you register on your own device, and the scoped access token Plaid issues once you authorize a retrieval. We never ask for, and never receive, your online banking credentials.
• Automatically. Standard request logs (method, URL, timestamp, and the IP address the request came from) for security and troubleshooting, and page-view and click analytics tied to an anonymous visitor identifier, not to your name or account.

Cookies

Session, invite, and attorney-session cookies are strictly necessary - they keep you signed in and keep the invite flow working, and are never used for tracking. A separate visitor cookie supports analytics only and is never used to authorize access to anything. A time-zone cookie holds your browser's time zone, so dates and times are shown in it; it holds nothing else.

How a Retrieval Moves

An invitee authorizes access at their own institution's login page. The institution confirms the authorization and releases records to Plaid under its agreement with that institution. The attorney's portal then retrieves the authorized records through Plaid using a read-only, scoped token, and displays them for that matter. No party in this chain receives more than the invitee agreed to share.

Revoking Access

An invitee can revoke an authorization at any time, from either their financial institution or their Civil Rule 26 account. Once revoked, no further retrieval occurs under that grant.

How We Protect Information

Authentication cookies are set as HTTP-only, secure, and same-site restricted. Request logs redact invite and session identifiers before they're written anywhere, and never capture credentials. All traffic to the site is encrypted in transit.

Third Parties

We share information with Plaid to aggregate authorized financial records, and with an invitee's own financial institutions as part of the authorization they initiate. To verify an attorney's license at signup, and for nothing else, we look up the state and bar number in the Washington State Bar Association's Legal Directory or through Data & APIs, which searches other states' bar directories for us. We do not sell personal information.

Changes to This Policy

If this policy changes in a way that affects how information is collected or shared, we'll update this page and change the date it was last revised.

Contact

Questions about this policy, or a request to revoke access or remove your information, can go to info@civilrule26.com.

Informational only. Nothing on this page is legal advice or creates an attorney-client relationship.