// Technical Architecture

Production-Grade Infrastructure from Day One

Legalitize was designed with scalability, security, and legal accuracy as non-negotiable constraints. This page documents the technical architecture for investors conducting due diligence.

View Codebase Overview Investment Overview →
// System Architecture

A layered, decoupled architecture built for scale

Five distinct layers, each independently deployable and horizontally scalable. No monolithic coupling between concerns.

CLIENT
React Application
Vite-bundled SPA. Component library with TypeScript strict mode. State management via React Query + Zustand. Fully responsive.
Document Preview Engine
Real-time preview of generated legal documents with formatting validation before export. PDF and DOCX render paths.
Case Management UI
Matter dashboard, timeline view, evidence vault interface, deadline alerts, and document generation wizard.
Authentication UI
JWT-based auth with refresh token rotation. Secure session management. Role-based access control per matter.
API
Express.js REST API
TypeScript, strict validation via Zod schemas. Rate limiting, request logging, error normalization middleware.
Authentication Service
JWT issuance, bcrypt password hashing, refresh token management, session invalidation.
Document Generation Service
Orchestrates AI calls, template selection, jurisdiction rule application, and Bluebook formatting pipeline.
File Service
S3 upload/download with signed URLs, AES-256 encryption at rest, content-type validation, virus scanning hooks.
LOGIC
Jurisdiction Rules Engine
Codified procedural rules for 50+ court systems. Rule trees determine formatting, page limits, caption structure, filing requirements per court.
Deadline Calculator
Statutory deadline computation from filing events. Business day calculation, court holiday awareness, appeal window generation.
AI Orchestration Layer
System prompt construction from jurisdiction rules + case context. Claude API management, retry logic, response validation.
Packet Assembly Engine
Assembles complete filing packets from generated documents + companion forms. TOC, TOA, certificate of service auto-generation.
DATA
PostgreSQL (Primary DB)
12 normalized schemas. Matters, parties, documents, timelines, evidence, deadlines, users, sessions, templates, jurisdictions.
Prisma ORM
Type-safe database client with migrations, seeding, and connection pooling. Eliminates SQL injection vectors at the ORM layer.
Redis Cache
Session caching, jurisdiction rule caching, API response caching. Reduces database load for frequent reads.
AWS S3 (Document Store)
Encrypted document storage. Versioning enabled. Cross-region replication for durability. Lifecycle policies for cost management.
EXTERNAL
Claude AI (Anthropic)
Primary AI model for legal document generation. Model: claude-opus-4-8. Legal system prompts with jurisdiction constraints.
Stripe
Payment processing, subscription management, metered billing for enterprise API customers, invoice generation.
Email (SMTP / SES)
Transactional email for deadline alerts, document notifications, account management.
Vercel / CDN
Frontend deployment with global CDN. Edge caching for static assets. Preview deployments per branch.
// Technology Stack

Modern, proven, enterprise-grade choices throughout

Every technology selection was made for production viability, developer ecosystem maturity, and long-term maintainability — not trend-following.

Frontend
React 18
UI Framework
TypeScript
Type Safety
Vite
Build Tool
Tailwind CSS
Styling
React Query
Server State
Zustand
Client State
Backend / API
Node.js
Runtime
TypeScript
Type Safety
Express.js
HTTP Framework
Zod
Validation
JWT + bcrypt
Auth
Stripe SDK
Payments
Data & Storage
PostgreSQL
Primary DB
Prisma ORM
DB Client
Redis
Cache
AWS S3
File Storage
SQLite
Local / Offline
AI & Infra
Claude (Anthropic)
AI Engine
PDF-lib
PDF Generation
Docxtemplater
DOCX Generation
Vercel
Deployment
Docker
Containerization
Nginx
Reverse Proxy
// Security Architecture

Security is not an afterthought. It's an architecture requirement.

Legal data is among the most sensitive data a platform can hold. Every layer of Legalitize treats security as a first-class constraint.

🔐
Data Encryption

AES-256 encryption for all documents stored in S3. TLS 1.3 for all data in transit. Database fields containing PII encrypted at the application layer in addition to transport security.

AES-256TLS 1.3
🔑
Authentication & Sessions

JWT with short-lived access tokens (15 min) and secure refresh token rotation. bcrypt password hashing (cost factor 12). Session invalidation on logout. CSRF protection via SameSite cookies.

JWTbcrypt
🛡️
API Security

Zod schema validation on all inputs eliminates injection vectors at the API boundary. Rate limiting per user and per IP. Request logging with anomaly detection hooks. CORS policy enforcement.

Zod ValidationRate Limiting
🔒
Data Isolation

Every database query includes user_id and matter_id scoping enforced at the ORM layer. No cross-user data access is architecturally possible through the API. Row-level security enforced by Prisma middleware.

Row-Level Security
📋
Compliance Posture

Architecture aligned with records access handling requirements for case records. Attorney-client privilege considerations documented in data handling policy. SOC 2 Type II pathway identified for enterprise customers.

records access-AwareSOC 2 Ready
🗃️
Document Integrity

SHA-256 hashing of all generated documents at creation. Version history maintained. S3 object versioning enabled. Document integrity can be verified against hash at any point — critical for legal evidentiary use.

SHA-256Versioning
// API Design

RESTful API designed for enterprise integration

The Legalitize API is built for both internal consumption and eventual enterprise partner integration.

// CORE ENDPOINTS
POST/api/mattersCreate matter
GET/api/matters/:idGet matter
POST/api/documents/generateGenerate document
GET/api/documents/:id/exportExport PDF/DOCX
POST/api/packets/assembleBuild filing packet
GET/api/deadlines/:matterIdGet deadlines
POST/api/records/requestDraft records request
GET/api/jurisdictions/:codeGet rules
POST/api/civil-rights/analyze§1983 analysis
POST/api/evidenceUpload evidence
POST /api/documents/generate — Request
{
  "matterId": "matter_8f2a3c91",
  "documentType": "MOTION_EMERGENCY_RELIEF",
  "jurisdiction": {
    "court": "EDPA",
    "division": "PHILADELPHIA",
    "caseType": "CIVIL_RIGHTS_1983"
  },
  "context": {
    "violations": ["14th_AMENDMENT", "4th_AMENDMENT"],
    "defendants": ["CITY", "OFFICER_A"],
    "urgencyLevel": "EMERGENCY"
  },
  "format": "PDF"
}

// Response
{
  "documentId": "doc_4e8f1b92",
  "status": "GENERATED",
  "pageCount": 14,
  "jurisdiction": "EDPA_PHILA_1983",
  "exportUrl": "/api/documents/doc_4e8f1b92/export",
  "bluebookValidated": true,
  "generatedAt": "2025-06-29T04:22:18Z"
}
// Scalability Design

Built to scale from day one.

<200ms
Target API response time (p95) with Redis caching layer active
H-Scale
Stateless API designed for horizontal scaling behind load balancer
∞
Document storage — S3 scales with zero configuration changes required
99.9%
Target SLA — achievable with standard cloud redundancy configuration
View Codebase Overview → Investment Materials →
SYSTEM ARCHITECTURE

The platform is a matter graph, not a document folder.

Every uploaded record can connect to parties, dates, issues, claims, events, exhibits, drafts, deadlines, and review notes. That architecture allows Legalitize to support multiple practice areas while preserving source-linked truth and reviewable output.

01

Ingestion Layer

Normalize PDFs, images, emails, notes, and structured records into a consistent matter workspace.

02

Matter Graph

Connect entities, events, issues, exhibits, claims, deadlines, communications, and draft context.

03

Review Layer

Keep human approval, attorney review, source citations, audit history, and version control in the workflow.