Legal

Privacy Policy

IOLTA Guard handles trust accounting records for law firms. This policy explains what we collect, why we collect it, and the controls you have over it.

Effective July 20, 2026

The Short Version

We do not sell your data, and we do not share it with advertisers.
The client, matter, and transaction records you enter belong to your firm. We process them only to provide the Service.
We do not use your trust accounting data to train machine learning models.
You can export all of your firm's data at any time, in CSV format.
Access is restricted to your firm. Every query is scoped to your firm's account at the database level.

Who This Policy Covers

Scope and roles

This policy applies to ioltaguard.comand the IOLTA Guard application (together, the “Service”). It covers two different kinds of information, and the distinction matters:

Account Data is information about you as our customer — your name, email address, firm name, and billing details. We are the controller of this data and decide how it is used.

Service Data is the content your firm enters into the application — client names, matters, ledger entries, bank transactions, and reconciliations. Your firm is the controller of this data. We are a processor acting on your instructions, and we do not use it for any purpose other than operating the Service for you.

Your firm is responsible for its own obligations to its clients, including the duty of confidentiality under your state's rules of professional conduct.

Information We Collect

And where it comes from

Information you give us

Account details — your name, email address, password (stored only as a salted hash), firm name, and role.
Two-factor authentication data — if you enable it, a secret used to verify your authenticator app codes, plus recovery codes.
Billing information — handled by our payment processor. We store a customer reference, subscription status, and the last four digits and brand of your card. We never receive or store full card numbers.
Trust accounting records — clients, matters, bank accounts, transactions, ledger entries, and reconciliations, including bank statement files you upload for import.
Support correspondence — messages you send us by email, phone, or the contact form.

Information collected automatically

Audit log entries — trust accounting requires an audit trail. We record who performed which action, on which record, and when, along with the originating IP address. These entries are deliberately immutable.
Session and security data — session identifiers, sign-in timestamps, IP address, and browser user agent, used to keep your account secure and to detect suspicious access.
Technical logs — error and performance logs generated while operating the Service.

A note on bank connections. IOLTA Guard imports bank data from statement files that you upload. We do not ask for, and do not store, your online banking username or password.

How We Use Information

Purposes of processing

To provide the Service — recordkeeping, reconciliation, reporting, and alerts.
To authenticate you and protect accounts against unauthorized access.
To maintain the audit trail your state bar expects you to keep.
To process subscription payments and send billing notices.
To send transactional email such as verification and password reset messages.
To respond to support requests.
To improve reliability and performance, using aggregate operational metrics that do not identify your clients.
To comply with legal obligations and enforce our terms.

We do not use your Service Data for advertising, and we do not use it to train machine learning models. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

When We Share Information

Service providers and legal requests

We share information only with vendors that help us operate the Service, and only to the extent they need it. Each is bound by contract to protect it and to use it for no other purpose.

Provider	Purpose	Data involved
Stripe	Subscription billing and payment processing	Name, email, billing address, and payment card details (entered directly with Stripe)
Email delivery provider	Transactional email — verification, password resets, alerts, and billing notices	Name and email address
Cloud hosting and database provider	Running the application and storing your data	All Service Data, encrypted at rest and in transit

We may also disclose information when:

We are required to by law, subpoena, or court order. Where we are permitted to do so, we will notify the affected firm before disclosing, so it can assert any applicable privilege on its clients' behalf.
It is necessary to investigate suspected fraud, a security incident, or a violation of our terms.
We are involved in a merger, acquisition, or sale of assets. Your data remains subject to this policy, and we will give you notice before it becomes subject to a different one.

How We Protect It

Security measures

Tenant isolation.Every firm's data is separated at the database level, so one firm's queries cannot reach another firm's records.
Encryption. Data is encrypted in transit with TLS and encrypted at rest.
Password handling. Passwords are stored as salted hashes. Nobody at IOLTA Guard can read your password.
Two-factor authentication. Available on all accounts, and recommended for anyone with access to trust records.
Least privilege. Staff access to production data is restricted to what is required for support and is logged.
Audit logging. Changes to financial records are recorded in an append-only audit trail.

No system is perfectly secure. If a breach affects your data, we will notify you and any required regulator within the timeframes the law requires.

How Long We Keep It

Retention and deletion

While your subscription is active, we retain your data so the Service works. State bar rules generally require attorneys to keep trust account records for five to seven years, so we are deliberate about giving you time to export before anything is deleted.

If your subscription is canceled:

Days 0–30. Your account becomes read-only. You can sign in, view everything, and export your full data set. We email reminders during this window.
Day 30. The account is archived and sign-in is closed. Contact us and we will restore access so you can export.
Day 90. Firm data is permanently deleted. We send a final warning one week beforehand.

Reactivating your subscription at any point before deletion restores your data intact.

We retain a limited set of records beyond this period where the law requires it — for example, billing and tax records. Backups are purged on a rolling schedule.

Export your data at any time.Firm administrators can download a complete CSV archive — transactions, clients, matters, bank accounts, and reconciliations — from the billing page, whether or not the subscription is active.

Your Rights

Access, correction, and deletion

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct information that is inaccurate.
Delete your account and associated personal information.
Receive a copy of your data in a portable format.
Object to or restrict certain processing.
Withdraw consent where processing is based on consent.
Not be discriminated against for exercising any of these rights. We will not degrade the Service because you made a request.

To exercise any of these, email info@ioltaguard.com. We will verify your identity and respond within the period the applicable law requires, generally 30 to 45 days.

If your request concerns Service Data belonging to a law firm we serve, we will refer you to that firm, which controls the data, and assist them in responding.

Some information cannot be deleted on request. Audit log entries are immutable by design, because their integrity is what makes them useful as a compliance record.

Cookies

What we set and why

We use cookies that are strictly necessary to run the Service: a session cookie that keeps you signed in, and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking sign-in.

We do not use advertising cookies, and we do not permit third parties to track you across other sites through our Service.

Children

Not directed to minors

IOLTA Guard is professional software for law firms and is not directed to anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

Where Data Is Stored

United States

IOLTA Guard is operated in the United States and your data is stored and processed there. If you access the Service from outside the United States, you are transferring your information into the United States, where privacy laws may differ from those of your jurisdiction.

Changes to This Policy

How we notify you

We may update this policy as the Service evolves. We will revise the effective date above, and for material changes we will notify account administrators by email or in-app notice before the change takes effect.

Questions About Your Privacy?

Reach out and a real person will answer. If you are evaluating IOLTA Guard for your firm and need a data processing agreement or a security review, ask us.

info@ioltaguard.com (844) 424-6582

Prefer a form? Contact us here.