Roles
Administrator, attorney, paralegal, bookkeeper, client and case contact, with per-matter read, upload or full permissions.
Security and ethics
Security controls we have, and claims we do not make
TaskWrangler runs on Google Cloud with each firm's data walled off from every other firm's, role-based access, two-step sign-in and audit trails. This page lists what is in place today and what is not, so your firm can make its own reasonable-efforts judgment.
Controls in place
Two-step verification
A code sent to the user's phone at sign-in, with prompts to enroll.
Firm isolation
Each firm's data is walled off from every other firm's at the database level, and that wall is tested automatically.
Audit trails
Who changed what and when, on tasks, matters, trust transactions, AI activity and outside connections.
Deletion requests
Data deletion requests are logged and reviewed by an administrator before anything is removed.
Credentials and logs
Connections to LawPay, Plaid and Anthropic use credentials kept in Google's secure vault, and client details are scrubbed from system logs.
Data location and handling
- Application data is stored in Google Cloud data centers in the United States and encrypted at rest by Google.
- Your documents remain in your Google Drive. TaskWrangler stores links, permissions and, for Counsel, a search index of text you have chosen to index.
- Counsel sends requests to Anthropic from TaskWrangler's servers in Google Cloud. Credentials are kept in Google's secure vault, never in the app. Document search uses Google's embedding model.
- Transcript retention for Counsel conversations is a firm-level setting with a scheduled purge.
- Deletion requests are recorded and reviewed by an administrator before anything is removed.
What we do not claim
- No SOC 2, ISO 27001 or HIPAA attestation of our own yet. Google Cloud and Firebase hold theirs; we will publish ours when it exists.
- No application-layer encryption beyond Google's encryption at rest.
- No data-residency options outside the United States.
- No client-facing AI assistant.
If your firm needs a data-processing addendum or a security questionnaire completed, email info@mattermouth.com. We answer them ourselves, in writing.
Professional responsibility and TaskWrangler
The rules below are the ones firms most often review before adopting cloud practice management and AI tools. This is information about how TaskWrangler's controls relate to them, not legal advice, and it does not substitute for your own analysis under your jurisdiction's rules, including the New Hampshire Rules of Professional Conduct.
Competence (Rule 1.1, Comment 8)
Lawyers keep abreast of the benefits and risks of relevant technology. TaskWrangler documents exactly what Counsel does and does not do, publishes its model list, and logs every AI run so you can explain it.
Confidentiality (Rule 1.6)
Reasonable efforts to prevent unauthorized disclosure. Controls: firm-level data isolation, per-matter permissions, two-step sign-in, automatic sign-out, firm consent before any AI use, privilege screening on your device, blocking of account numbers and passwords, and a private working folder for unreviewed drafts. The New Hampshire Bar Association Ethics Committee's advisory opinion on cloud computing (2012-13/4) describes the diligence expected when using cloud services; review it with your own facts.
Safekeeping property (Rule 1.15)
Trust accounts, trust transactions and a trust audit log are separate records with nightly balance checks. Reconciliation reports export to PDF for your files. Your firm remains responsible for the reconciliation and the records.
Supervision of nonlawyer assistance (Rules 5.1 and 5.3)
Counsel never acts on its own. Every proposal is reviewed and accepted by a named person and that acceptance is logged. ABA Formal Opinion 512 (2024) on generative AI discusses the supervision, confidentiality and fee considerations most firms review before adopting an AI tool.
Communications about services (Rule 7.1)
This site is held to the same standard we expect of a lawyer's advertising: no false or misleading statements. We do not claim certifications we do not hold, features that are not shipped, or results we cannot show.