For boutique law firms
Client files your firm can prove nobody else can read
TKJ Legal Vault is an end-to-end encrypted document vault with frictionless client sharing and tamper-evident audit trails — built for the confidentiality duties of legal practice (SRA / ABA Model Rule 1.6 / GDPR).
Zero-knowledge encryption
Documents are encrypted with AES-256-GCM in your browser before upload. The server stores ciphertext and envelopes only — it cannot read a single page, and neither can we.
Client sharing without accounts
Send a link; the decryption key travels in the URL #fragment, which browsers never transmit to the server. Clients open documents in any browser — no signup, no software.
Chain-of-custody audit log
Every upload, view, download, share and recovery is recorded in a SHA-256 hash chain. Any tampering with the log is mathematically detectable — evidence-grade accountability.
Firm-held key escrow
Dual-envelope recovery (X25519) lets managing partners restore a departed colleague's vault using an offline emergency passphrase. The platform vendor is never in the loop.
How the zero-knowledge flow works
[Your document] ──AES-256-GCM (in browser)──► [Encrypted blob] ──► TKJ Legal Vault storage
▲ │
DEK per file, wrapped by your User Master Key │
UMK wrapped by (1) your passphrase (2) the firm escrow public key ▼
Share link: https://vault.firm.com/share/abc123#<decryption-key> (── never sent to server)Everything after the # stays in the recipient's browser. Expiry, download limits and revocation are enforced server-side on metadata — the server still cannot read the document it is refusing to serve.