Client confidentiality is your obligation, so keeping it is ours. Here is exactly how Filebird protects the matters, documents and trust money you trust it with.
AES-256 · Hosted in Australia · SSO and 2FA
★★★★★
4.8
trusted by 2,400+ law firms
Six safeguards on every account from the first sign-in. None of them cost extra, and none of them need setting up.
AES-256 at rest and TLS 1.3 in transit. Documents, ledgers and file notes stay unreadable to anyone who should not see them, us included.
Trust ledger, October.xlsx
c41e 08ab 7d93 f2c6
File note, 12 Oct.docx
e9b0 3f71 a5d2 6c4e
Stored in Sydney and backed up in Melbourne. Client data never leaves the country.
Sydney · primary
Melbourne · backup
Single sign-on with Microsoft or Google, two-factor for everyone, and roles for partners, staff and bookkeepers.
Microsoft
4
8
2
9
1
3
Code expires in 28 seconds
Verified
Partner
Staff
Bookkeeper
All matters · Trust ledgers · Billing
Who opened, changed, exported or deleted what, and when. Export it for an audit in one click.
Margot exported a trust ledger
09:42
Ravi opened a matter
09:38
Elena changed a user role
09:31
Lukas shared a file with a client
09:24
Claire signed in with two-factor
09:17
Margot deleted a draft
09:05
Ravi restored a document
08:58
Export for an audit
A snapshot every hour, kept for 30 days and restorable by our team in minutes.
Restore to 14:00
10:00 yesterday
Now
Last snapshot 09:00 · Next in 18 min
Live status for every part of Filebird. Planned maintenance happens on Sunday mornings, Sydney time, with a week’s notice by email.
Everything is running normally
App
Matters, documents, time and trust
Client portal
Sharing, messages and payments
Billing and payments
Invoices, Stripe and Square
Email and calendar sync
Outlook, Gmail and Google Calendar
API and webhooks
REST API and event delivery
No issues
Degraded
Planned maintenance
Recent incidents
Email sync delayed for some Outlook accounts
Messages filed up to 40 minutes late. Nothing was lost.
38 min
Resolved
Scheduled maintenance: database upgrade
Announced a week ahead, on a Sunday morning, Sydney time.
20 min
Planned
Slow invoice PDFs
Invoice downloads took up to a minute while a queue cleared.
1 h 12 min
Resolved
What we promise every firm, in plain English. The full detail lives in our privacy policy and terms of service.
01
In writing
The promise
We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles. If a breach is likely to cause serious harm, we tell you without undue delay and notify the OAIC.
In force for every firm
The proof
Breach response plan
Notifiable Data Breaches scheme
Contain
Lock down the affected access
Within hours
Assess
Is serious harm likely?
Within 30 days
Notify
You, the people affected and the OAIC
Without undue delay
02
In writing
The promise
An outside security firm tests Filebird at least once a year. We fix critical findings before our next release and share a summary report on request.
In force for every firm
The proof
External penetration test
June 2026
Independent firm · web app, API and client portal
None found
1 of 1 fixed
3 of 3 fixed
6 of 6 fixed
Summary report available to customers on request
03
In writing
The promise
Our staff cannot open your files by default. Access is granted for a single support request, limited in time and recorded in your audit log.
In force for every firm
The proof
FB
Filebird Support asked to open one matter
Ticket 4821 · today, 2:02 pm
Ruiz v Hartley Holdings
Read only
Approved by Hannah Price, practice manager
Access ends in 59:12
Recorded in your audit log
04
In writing
The promise
Export everything at any time in open formats. If you leave, you have 90 days to export, then we delete your files and confirm it in writing. Encrypted backups age out within a further 35 days.
In force for every firm
The proof
Full export
Open formats
You leave
90 days to export
Deleted, confirmed in writing
05
In writing
The promise
We publish every provider that touches your data, and we give you 30 days’ notice before we add a new one.
In force for every firm
The proof
Sub-processors
Updated 2 October 2026
Cloud hosting
Sydney, AU
Email delivery
United States
New provider
Announced to every firm before it starts
30 days’ notice
Email security@filebird.com. We reply within one business day, keep you posted while we fix it, and credit you publicly if you would like.
