Security

Last Updated: August 2026

This page describes how IPR Manager protects your data and documents. It is intended for practitioners, firms, and platform reviewers evaluating our controls — not as a substitute for the Privacy Policy, which covers data collection, retention, and your rights in detail.

In short: your case data is stored in India, encrypted in transit and at rest, with access limited to people you invite. The sections below add detail for security reviewers.

Core Security Commitments

Your Inventions are Trade Secrets: Before publication, every patent disclosure is a trade secret. A leaked draft destroys novelty. We build privacy into every layer.
Zero AI Training on Your Data: Your invention disclosures, claims, and specification drafts never train any foundation or public AI model. Enterprise AI contracts contractually guarantee zero data retention for model training.
No Data Selling. Ever.: We generate zero revenue from advertising or data brokerages. Your case data, client records, and drafts are never sold, shared, or monetized.
AES-256 Encryption: Every byte — databases, backups, uploads — encrypted at rest with AES-256 and TLS 1.3 in transit. Always on, cannot be disabled.

Infrastructure

IPR Manager runs on Google Cloud and Firebase, with application logic deployed in Google Cloud's India region (Mumbai). We do not operate our own servers or data centres. Platform reliability, physical security, and infrastructure-level redundancy are provided by Google Cloud.

We do not store payment card or UPI credentials. Subscription billing is handled entirely by a third-party payment processor; IPR Manager never receives or processes raw card data.

Data in transit

All traffic between your browser and IPR Manager — including document uploads, downloads, and API calls — uses HTTPS (TLS). Unencrypted HTTP connections are not accepted.

Access controls

Access to case data is enforced at the server, not just in the interface.

Staff access is scoped by firm and role (admin or member). Client portal users access only matters explicitly shared with them. Sensitive operations — including document storage, encryption, and billing — are handled through server-side logic that enforces these checks independently of what the browser sends.

Direct client writes to canonical document storage are blocked at the infrastructure level.

Document protection

Case documents uploaded to IPR Manager are protected in two layers.

Platform encryption: All files stored on Google Cloud Storage are encrypted at rest by Google Cloud as a baseline.

Application-layer encryption: Documents uploaded after our encryption feature was enabled receive an additional layer of protection applied before the file is written to storage. Each document is encrypted individually with its own unique key. That key is then secured using Google Cloud Key Management Service (KMS) — a managed, audited key store operated by Google Cloud. Encryption keys are never stored alongside document content, and are never written to the client-accessible database.

Downloads of encrypted documents are served through a server-side process. Your browser receives file content directly — not a link to the underlying storage object.

A note on legacy documents: Files uploaded before the encryption feature was enabled are protected by Google Cloud's platform-level encryption. They are not automatically re-encrypted at the application layer. New uploads receive full application-layer protection from the point of upload.

We do not currently offer zero-knowledge encryption, customer-managed keys (BYOK), or client-side encryption.

Audit logging

Upload and download activity on case documents is logged, including access attempts that are denied due to insufficient permissions. These logs are used for operational monitoring and, where applicable, security investigations.

Backups and retention

Google Cloud provides infrastructure-level redundancy across its storage services. Application-level retention periods — including for billing records, security logs, and deleted account data — are described in the Privacy Policy.

Incident response

If you suspect unauthorised access to your account or a security vulnerability in the platform, contact us at support@iprmanager.com. We treat security reports as high priority. Depending on the nature of an incident, our response may include revoking active sessions, restricting access to affected features, and rotating encryption keys.

Connected mailbox (email sync)

Email sync lets authorised organisation admins (or solo practitioners on their own workspace) connect a prosecution mailbox via OAuth.

Control	Detail
Scopes	Google: `gmail.readonly` (read-only). Microsoft: `Mail.Read` (read-only).
Tokens	Refresh tokens stored in Google Secret Manager per connection — not in Firestore or the browser.
Who can connect	Solo account owner, or org admin / billing owner for firm workspaces.
What is indexed	Allowlisted IPO sender messages only; snippet cap ~2 KB; optional ops-only raw cache in Admin Storage with lifecycle deletion.
Disconnect	Revokes tokens and deletes connection-scoped sync cache; case and Watchtower history on matters is retained.

What we do not claim

No system is completely immune to security incidents, and we will not represent otherwise. IPR Manager is a workflow and portfolio management platform, not a legal advisory service. Encrypted document search, data loss prevention, and per-document download watermarking are not part of the current standard offering.

For questions about data collection, retention, or your rights, see the Privacy Policy. For platform terms, see the Terms and Conditions.