Aparsoft LegalOS
The Operating System for an Indian Law Firm
How Aparsoft built a law firm's entire digital practice — public presence, intake, scheduling, engagement letters, matter tracking, a privilege-aware document vault, a client portal and a citation-only AI assistant — as one product where compliance is enforced by the data model rather than by disclaimer copy.
See It in Action
Firm identity as data, not code — trading name, legal name and constitution are editable fields. Seeded demo firm, not an actual client.
The Challenge
Ask a partner where the practice hurts and you will not hear “we need a website.” Indian law firms run on WhatsApp, email attachments and a site nobody has updated since it was built — and the two software categories that could help both fail them. Generic practice-management tools cannot answer the Bar Council of India's advertising rules or the DPDP Act. Agencies build a brochure and hard-code the firm's identity into it, so the second firm costs as much as the first.
The firm's most public asset is stale, and every change means emailing a developer and waiting a week
Enquiries arrive in five places — phone, WhatsApp, a form, a referral, a walk-in — and nobody can say how many came last month or about what
Clients send Aadhaar scans to an associate's personal number; confidential material sits outside the firm's control with no record of who opened it
Compliance is managed by doing less — firms under-market out of fear of Rule 36, which is its own cost
What LegalOS Does
One product, configured per firm. The needs of Indian law firms are ~85% identical; the identities are 100% different and are entirely content and configuration. LegalOS builds the needs once and expresses the identity as data — which is why a firm changes its own colours, menu, pages and team without calling us, and why the next firm is delivered in days rather than months.
A Disclaimer Gate That Actually Gates
The server returns the notice instead of the page, so an unacknowledged visitor's content is never rendered and never sent — there is nothing behind the notice to uncover. Verified by building the site, serving it and inspecting the bytes: 39,895 bytes with no page content for an unacknowledged visitor, 63,063 with it for an acknowledged one. The acknowledgement records the exact version of the wording shown.
Compliance Enforced by the Data Model
There is no field anywhere to enter a success rate, a win rate or cases won — it cannot leak because it does not exist. Services have no price field; fees live only inside an engagement letter. Testimonials require legal review, stored written consent and an anonymisation option, and default to off. DPDP consent text is stored per record, so the firm can prove not just that consent was given but what was agreed to.
An Assistant That Refuses Without Citations
Retrieval-grounded only — no sources, no answer. It hard-refuses outcome predictions, fee quotes, limitation-period questions and “should I sue”, converting each into an offer to speak to a human. Public and internal material are separated at the source, and that audience filter was built and attacked before the corpus held a single document.
A Document Vault Built for Privilege
Documents belong to a matter and are never globally listable. Confidentiality level drives visibility even for internal staff, enforced at two independent layers. Files are stored in a private bucket with no public route and served through signed URLs that expire in five minutes. Every view and every download is logged.
Engagement Letters, Accepted and Recorded
Generated from the firm's own templates with scope and fee written down, sent to the client, and accepted online with a timestamped record. Recorded online acceptance is the evidentiary record — deliberately, rather than bolting on e-signature theatre.
One Database Per Firm, Enforced by PostgreSQL
Not a shared table with a filter on it. Each firm's application literally cannot open a connection to another firm's database — refused at the connection layer before any query exists, so no application bug, missing WHERE clause or forgotten queryset override can leak privileged material between clients. Demonstrable on a screen share in thirty seconds.
What the Build Proves
The first firm is a build; the fifth is days of configuration with effectively no new engineering — because the firm's identity is data, enforced by a CI check that fails the build if a client's name appears anywhere in the source.
