How Bundle-B protects your data

Data sent between your browser and Bundle-B is encrypted in transit using HTTPS (TLS).

Google Cloud encrypts all stored data at rest by default, using encryption keys that Google manages.

Card payments are handled by Stripe. Bundle-B does not store payment card numbers.

You must sign in to use Bundle-B. Security rules limit each firm's documents and records to signed-in members of that firm. Any access not specifically allowed is denied.

Firm roles control who can create and edit bundles, and who can manage users, billing and permanent deletion. Each plan's seat limit is checked when a firm administrator adds a user.

Designated Legal Merits administrator accounts can access firm accounts to provide support and to administer the platform and billing.

Generated PDFs remain in private firm-scoped storage. Anyone with a randomly generated share link can open the file without an account or password; the link resolves to a temporary file URL. Treat the link like a key and share it only with intended recipients. When a bundle is permanently deleted, its files are removed and its links stop working.

When a firm administrator permanently deletes a bundle, its files are removed straight away. Google Cloud can still recover deleted files for up to 7 days, after which they are permanently erased.

When another user deletes a bundle, it is hidden and can be restored by a firm administrator. An automatic monthly clean-up permanently removes it once it has been deleted for at least 30 days.

For each bundle and hearing date, Bundle-B keeps the latest generated version. Earlier versions are removed automatically 14 days after they were generated.

You can ask us to close your account and delete your data. Our Privacy Policy explains how long account data is kept after an account is closed.

Bundle-B does not send your documents to any external AI or machine-learning service, and does not use them to train AI models.

Indexing, pagination, bookmarks and bundle generation are done by software running within Bundle-B's own systems in the London region.

Held by our infrastructure provider, Google: Google Cloud is independently certified to ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018, and is audited under SOC 2. Google also holds NCSC Cyber Essentials Plus for its relevant UK operations. Details are on Google Cloud's compliance page.

Bundle-B and Legal Merits: these are Google's certifications for its own infrastructure and operations. They do not certify the Bundle-B software or Legal Merits Limited.

Google processes data for Bundle-B under its Firebase and Google Cloud data processing terms. We handle personal data under UK GDPR and the Data Protection Act 2018, as described in our Privacy Policy.