AES-256 encryption. Cryptographic chain of custody. Zero-knowledge architecture. Built for the demands of federal litigation, where the authenticity of a document decides the case.
Digital records have become the foundation of modern litigation — and they are systematically vulnerable. The absence of cryptographic proof doesn't mean tampering didn't happen. It means you can't prove it did. That gap has consequences measured in verdicts.
Dropbox, Google Drive and SharePoint have audit logs and version history, and for their intended purpose they work. What they are not built to produce is a recipient-verifiable sealed manifest or a cryptographic integrity certificate — the artefact you hand a court when authenticity is challenged.
Electronic health records are architected to permit modification after production. Without cryptographic anchoring at acquisition, a later version is indistinguishable from the original.
No timestamp, no hash, no audit trail. When opposing counsel challenges authenticity, the answer "we saved the file" is not an answer.
Many conventional eDiscovery platforms rely on vendor-controlled administrative access and key management. In adversarial proceedings, access held by anyone other than the firm is a liability the firm inherits.
The question in every high-stakes case is no longer whether digital evidence can be altered — it's whether you have the cryptographic proof to show that it wasn't.
// Why this matters now
A release link and a token, sent on separate channels. The key is derived inside their browser — never transmitted, never escrowed, never known to us. Every object is re-verified against its sealed digest before it can be downloaded. Watch it open.
The documents held here are encrypted at rest with AES-256-GCM. The key is derived from the access token inside the recipient's own browser.
Not features. Legal outcomes. Every architectural decision in L-VAULT traces to one question: does this support an authentication and chain-of-custody showing.
True zero-knowledge design. Your evidence is encrypted under AES-256 keys that only you control. No administrator override, no vendor access, no exception.
AES-256 in GCM mode, specified in FIPS 197 and SP 800-38D, with keys derived by PBKDF2-HMAC-SHA256. Every choice is a published standard your own people can audit.
Every object is hashed and anchored the moment it enters the vault. Any subsequent modification, of any length, produces a different digest.
Each request for a release page and for each encrypted object is recorded server-side with its timestamp. The delivery path runs no application server, so what is logged is what the web server observes — not events inside the recipient's browser.
L-VAULT continuously monitors your vault against cryptographic baselines. Any deviation triggers immediate notification with proof attached.
Generate integrity certificates designed to support authentication and chain-of-custody showings: a digest recorded at ingest, and the same digest recomputed by the recipient.
AES-256 is not marketing language. The algorithm is specified by NIST in FIPS 197. Its use to protect classified information on national security systems is approved under the CNSS and NSA standards for those systems — CNSSP-15 and the Commercial National Security Algorithm Suite. That is the floor L-VAULT is built on, and the claim is checkable against the published standards rather than against us.
At the moment of upload, L-VAULT generates a SHA-256 hash of the original file. That hash is the document's cryptographic identity, fixed before anything else touches it.
Your firm's keys are generated client-side and never transmitted. Encryption happens before anything leaves your control, so the vault holds ciphertext it cannot read.
Every stored object is checked against its cryptographic baseline. Any deviation — any change of any size — is detected rather than assumed away.
Retrievals are recorded where they can be: at the web server. A request for a release page or an encrypted object is logged with its timestamp. Because decryption happens in the recipient's browser, events there — including a mistyped token — never reach the server and are not claimed to be recorded.
Generate an integrity certificate for any document or set, showing that what was produced is byte-identical to what was sealed — designed to support authentication and chain-of-custody showings rather than to substitute for them.
L-VAULT is not general-purpose storage. It is purpose-built evidence defense infrastructure for firms handling matters where authenticity is contested.
Productions spanning thousands of pages across multiple defendants, where opposing parties have both the motive and the access to alter the record.
EHR systems permit post-production modification. L-VAULT anchors healthcare records at acquisition, before anyone can revise them.
Pattern cases requiring document integrity maintained across years of evidence and dozens of custodians.
Evidence leaving a source under institutional threat, with cryptographic provenance established at acquisition.
Integrate an AES-256 cryptographic integrity layer into existing document review workflows.
Cases where financial records, communications and transactional documents form the evidentiary core.
Before a firm can adopt anything that touches client evidence, someone has to review it. These are the documents that review needs. Published means it is on this site now; on request means it is sent under NDA when a firm is onboarded.
Cipher, key derivation, where keys exist and where they do not, what the server can and cannot read, and how a recipient verifies a production independently.
What is stored, for how long, how deletion is performed and what remains afterwards.
Contractual terms, limitations, and the service commitments made to a firm.
Every third party in the path, what each one can see, and the jurisdictions data rests in.
Detection, notification timelines, and what a firm is told when something goes wrong.
Where L-VAULT stands on protected health information, and what is required before a matter involving medical records is onboarded.
Who operates L-VAULT, and how to reach a human about a vulnerability or a security question.
L-VAULT is in closed beta and is being proven on live matters before anyone else is let near it. There is no sign-up, no waiting list and no sales process — this page exists to document the system, not to sell it. The architecture is published in full if you want to examine it in the meantime.
Read the Documentation