← Back to 4All.Help

Security & Trust

Reviewed and last updated: August 1, 2026

What we can honestly promise

We do not sell account data, use it for advertising, or give facility staff routine access.
Authorized service components process information only as needed for requested features, security, operations, deletion, and legal obligations.
We use layered safeguards and fail-closed checks, but no system, encryption method, or AI model is perfect.

1. What Happens to a Request

Your device sends the request to 4All.Help over an encrypted HTTPS connection.
The server authenticates the account when required, checks product and user authorization, and limits the data selected for the requested feature.
If the feature uses AI, the necessary text is sent to a currently disclosed provider. Public demonstration requests use Google with OpenAI as a fallback; approved-account AI features may use Anthropic, Google, or OpenAI after consent.
For governed 4All legal answers, source checks run before release. An answer that does not meet the configured verification boundary is withheld.

2. Protection Layers

Connections

Production web traffic uses HTTPS. This protects data in transit, although no network transmission is risk-free.

Stored sensitive fields

Authenticated AES-256-GCM encryption is used for sensitive stored fields. Authorized service code can decrypt information when a requested feature requires it.

Passwords

Passwords are stored as one-way PBKDF2 hashes with 600,000 iterations. Strong hashing reduces risk but does not make a weak or reused password safe.

Sessions

Production sessions use signed, secure, HttpOnly cookies, server-side expiry, revocation records, and request-forgery defenses. A copied credential can still be dangerous until it expires or is revoked.

User isolation

Canonical database-backed authorization checks scope account and matter operations to the current user. Administrative access is limited and should be used only for authorized operations, support, security, or legal obligations.

3. Legal-Source Verification

4All.Help checks cited authority against governed source records and can attach official-source receipts. The correctional public-answer path buffers the generated answer and withholds it if required checks do not pass. These controls reduce fabricated or unsupported citations; they do not guarantee that an answer is complete, current, legally correct, or suitable for a particular case. Always open the official source and confirm it yourself.

4. Deletion That Fails Honestly

Deleting a matter or account starts database scrubbing and stored-object deletion. Storage work is tied to the backend where an object was created. If that backend is unavailable or deletion fails, an opaque durable cleanup job remains for retry. The service does not report required cleanup complete while that work is unresolved. Access is denied while erasure is in progress.

5. Shared Devices

Use a private username and a unique password. Do not save the password in a shared browser.
Sign out when finished and close the browser or app. Do not assume walking away, closing one tab, or deleting a shortcut ended the server session.
Clear downloaded files and browser downloads when the device policy allows. 4All.Help cannot control screenshots, device monitoring, browser history, or files retained by a facility-managed device.
Contact us if a session or account may be compromised so it can be revoked or disabled.

6. Reporting a Concern

No system is perfectly secure. If you find a vulnerability, believe an account was accessed without permission, or have a question about these safeguards, email security@benchslap.pro. Do not include a password, private document, or exploit payload in the first message.