Firms move their clients’ most sensitive documents through Firmary. Here is how that’s handled.

Every upload is scanned: Files a client or firm uploads are virus-scanned before anyone can download them; infected files are quarantined, never delivered.
Sensitive actions are audited: State-changing actions land in an append-only audit log, scoped to the firm, so there is always a record of who did what, and when.
Firms are isolated: Each firm is a hard tenant boundary. Every read and write is authorized server-side against that boundary, and cross-tenant isolation is exercised in our test suites.
Sign-in is standards-based: Authentication uses OpenID Connect with multi-factor support (email codes and authenticator apps). Sign-in and invitation endpoints are rate-limited, and the limiter fails closed.
Credentials are encrypted: Per-firm integration credentials are encrypted at rest with AES-256-GCM. Payment card data never touches Firmary — Stripe is the system of record for charges.
What we haven't done yet: Firmary is pre-launch. We run internal security reviews and automated secret scanning, but we have not yet completed a third-party audit or SOC 2 — that work is planned before general availability, and we'd rather say so than imply otherwise.