1.1
Per-firm database isolation
Your practice gets its own database — not rows in a shared table behind a filter clause. Another firm's matters are not one bug away from yours; they are in a different database entirely.
Security & compliance
Client confidentiality,
enforced by architecture.
Your clients trust you with privileged information. Oberon protects that trust structurally — every firm in its own database, every action on an audit trail that cannot be modified or deleted, all of it inside the European Union.
PER-FIRM DATABASE TOTP 2FA TLS 1.3 EU RESIDENCY IMMUTABLE AUDIT
Defence in depth
No single point of failure.
By design.
Security is layered through infrastructure, application and data — so no one failure can compromise a client file.
1.2
Encryption throughout
TLS 1.3 for every connection in transit, 256-bit AES for data at rest, and encrypted backups held in geographically separate EU locations.
1.3
Two-factor authentication
TOTP-based 2FA — the same standard used by Google and Microsoft. A stolen password alone gets nobody in, and administrators can enforce 2FA across the whole firm.
1.4
EU data residency
Client data is processed and stored exclusively within the European Union, with primary residency in Ireland. No data leaves the EU.
1.5
Backups & recovery
Automated daily backups with point-in-time recovery, on redundant infrastructure with automatic failover — and you can export your own data whenever you wish.
1.6
Hardened perimeter
DDoS protection, a web application firewall, rate limiting and brute-force lockouts, with infrastructure monitored and alerting around the clock.
The record of everything
Every action recorded.
None of it erasable.
Oberon keeps a complete audit trail of every action taken on the platform — document access, ledger postings, permission changes, AI usage. The audit trail cannot be modified or deleted — not by a user, not by an administrator.
- User, timestamp and action recorded for every event.
- Filterable, searchable audit reports for compliance reviews.
- Exportable logs for regulatory inspections and Law Society audits.
- Document version history with full change tracking.
- Every AI interaction logged, alongside human ones.
14:32 s.mccarthy uploaded lease_agreement_v3.pdf
14:18 j.osullivan posted time entry 1.5 hrs — client conference
11:45 e.fitzpatrick updated status → in progress
09:12 system sent deadline reminder to matter team
09:02 ai assistant drafted reply · filed with citations
5 of 247 events · append-only · no delete, no edit
Under the bonnet
The engineering you'd hope for,
written down.
Most vendors stop at the brochure words. Here is how the platform actually handles credentials, sessions and connected tools.
Server-side sessions
Sessions are held server-side in the platform database, never in browser-readable storage. Administrators can review active sessions, revoke them, and enforce two-factor authentication firm-wide.
Hashed API keys
API credentials are stored only as peppered SHA-256 hashes — the plaintext is never persisted — and every check uses a constant-time comparison.
Signed webhooks
Every webhook Oberon sends carries an HMAC-SHA256 signature, so your systems can verify a payload genuinely came from us before acting on it. Failed deliveries retry with backoff — nothing is silently dropped.
OAuth 2.1 for connected tools
External tools authorise through a spec-compliant OAuth 2.1 flow with PKCE. Tokens are bound to a single firm, and every user can see and revoke an application's access at any time.
AI that keeps confidences
The AI assistant works inside the same walls as everyone else: it sees only what the asking user is permitted to see, your firm's data is never used to train external models, and every AI interaction lands on the audit trail. Administrators can switch AI features on or off for the firm.
Professional obligations
Built to Law Society standards,
in all three jurisdictions.
Compliance is not a module bolted on afterwards — the accounting engine, client-care workflows and reports are built around the rules your regulator will actually test.
4.1
Ireland
Built to Law Society of Ireland requirements: client and office ledgers kept properly apart, Section 68 client care letters generated and tracked, and AML workflows aligned with the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010–2021. The Solicitors Accounts Regulation Return is a built-in report, computed from live ledgers.
4.2
Northern Ireland
The same double-entry engine and client-account discipline applied to Northern Ireland practice — client money accounted for to Law Society of Northern Ireland standards, with the full audit trail behind every figure.
4.3
England & Wales
Aligned with the SRA Standards and Regulations, including the SRA Accounts Rules 2019, with client care letters and cost transparency tracked on the matter itself.
Data protection
GDPR compliance,
built in from the first line.
Designed to meet the General Data Protection Regulation and the Irish Data Protection Act 2018 — and the UK GDPR for firms in Northern Ireland, England and Wales.
5.1
Data processing agreements
Comprehensive DPAs for every firm, defining roles, responsibilities and processing activities in line with Article 28.
5.2
Data subject rights
Tools for data subject access requests and the right to erasure, so your firm can respond within the required timeframes.
5.3
Records of processing
Records of processing activities maintained within the platform, keeping your Article 30 obligations current.
5.4
Breach notification
Incident response procedures aligned with the 72-hour notification requirement under Article 33, with alerting and documentation.
5.5
Privacy by design
Data minimisation and purpose limitation are embedded in every feature as it is built, as Article 25 requires — not audited in afterwards.
5.6
Data residency
All client data processed and stored exclusively within the EU, primary residency in Ireland. Your data protection story is one sentence long.
Security questions? We're an open book — ask the people who built it.