From first notice of loss to final distribution, in one system.
Property firms run a case manager, a CRM, an estimating spreadsheet and a trust ledger that do not talk to each other. Claim Ledger makes coverage, statutory clocks, estimate reconciliation, fee exposure and co-counsel access reads against a single underlying ledger — so the answer is the same everywhere you ask.
In limited pilot with policyholder firms. Homeowner claims first.
The problem is not any one of your systems. It is the seams between them.
Every tool in a property practice is competent at its own step. Value leaks in the handoffs — where a fact gets retyped, a date gets assumed, or a number stops being connected to the document it came from.
Intake to coverage
A signed retainer tells you nothing about whether the loss is covered. The declarations page does — and in most firms it gets read properly for the first time weeks after the file opens, by which point the deductible basis and the roof-surfacing schedule have already shaped the demand.
Coverage to clocks
Statutory deadlines do not all anchor to the date of loss. Florida runs its notice window from policy inception. Texas measures acceptance from the date the carrier received the items it requested. A calendar that anchors everything to one date is quietly wrong in most states.
Estimate to money
The carrier estimate arrives as a PDF. Someone retypes line items into a spreadsheet, and the difference between your scope and theirs — the actual subject of the case — lives in a file nobody else can open.
Money to distribution
A settlement has to clear a mortgagee, a public adjuster fee, advanced case costs, a co-counsel split and a contingency before the client sees a dollar. That waterfall is almost always reconstructed by hand, under time pressure, at the moment it matters most.
Firm to co-counsel
Associating counsel in a state you are not licensed in is normal practice and how firms cover a region. Sharing the file usually means emailing attachments — which is both a security problem and the reason nobody can say who saw what.
Everything to the record
When a fee dispute, a bar complaint or a bad-faith claim arrives, the question is what was known and when. Systems built around documents can show you the document. They cannot show you the state of the claim on a date two years ago.
One object model, twelve ways to look at it.
A coverage part, a deductible, a mortgagee interest, a public adjuster fee, an advanced cost and a contractor invoice are the same shape of thing: a claim on a sum, held by a party, governed by an instrument, subject to a clock. Model that once and coverage review in week one and lien resolution in month eighteen stop being unrelated workflows.
Intake and conflicts
Lead capture through engagement, with the conflicts check as a precondition the system enforces rather than a task someone remembers.
Policy and coverage parts
Coverage A/B/C/D, endorsements, sublimits and deductible basis modeled as first-class objects. Percentage deductibles compute off the Coverage A limit, not the loss.
Statutory clock engine
Per-jurisdiction, date-effective rules with the citation attached. Carrier clocks and firm clocks are never the same color, because one is leverage and the other is forfeiture.
Estimate reconciliation
Ingest Xactimate and Cotality estimates, line-match against your own scope, and surface the delta by trade — the case, expressed as a table.
The money ledger
RCV to depreciation to ACV to deductible to prior payments, with recoverable and non-recoverable depreciation tracked separately and labor depreciation resolved per state.
Distribution and trust
The full waterfall — mortgagee, public adjuster, costs, co-counsel split, contingency — with a bar-ready three-way reconciliation artifact.
Fee exposure
Model what the fee actually is under the governing regime before you send the demand, not after the judgment.
Co-counsel access
Grant another firm scoped access to one matter. They see that matter. They never see your other clients.
Time capture
The timer prompts when a file opens and confirms when you leave it, because time not captured at the moment of work is time reconstructed on Friday.
Document provenance
Every extracted figure keeps a pointer back to the page and line it came from, so a number in the ledger can always be traced to the paper it came off.
Status card
A maintained current-state summary of each matter, so reviewing a file after a month does not mean reading a month of notes.
Audit and legal hold
A hash-chained, append-only record of reads as well as writes. A hold always beats a retention schedule, through one enforced choke point.
All 56 jurisdictions from day one — and we tell you which ones we have verified.
Nobody can honestly ship fifty states of verified statutory deadlines on a launch date. An unverified date is worse than no date: it is a malpractice event with our name on it. So the registry covers every jurisdiction as a structure, and each rule carries its own status that governs how the product behaves.
These counts are read live from the production rules registry on every page load. They are not a marketing figure we maintain by hand.
Co-counsel without emailing the file.
A Texas firm takes a Louisiana hurricane loss and associates Louisiana counsel. Both firms work the same matter. Neither should see the other’s other clients. That is not a permissions screen — it is a property of the database.
What the grant does
- ✓Access is scoped to one matter, with an effective window and a revocation that takes effect on the next query.
- ✓Capabilities are granular. A grant can carry notes.write without handing over the money ledger.
- ✓An ethical wall is a deny that beats every allow, including ownership.
- ✓Every read is logged with the party who made it, not just every write.
What the database refuses
- ✕Activating a fee-sharing grant with no client written consent on file. Model Rule 1.5(e)(2) makes the writing a precondition, so the schema does too — it raises an error, it does not warn.
- ✕Activating a grant before the conflicts check against the associating firm has run.
- ✕Deleting anything under a legal hold, whatever the retention schedule says.
Isolation is a database property, never an application promise.
Your diligence questionnaire will ask how tenant data is separated. The honest answer for most platforms is “the application always adds a filter.” That cannot be evidenced to an auditor and cannot survive one careless query.
- ✓Row-level security in Postgres, keyed to the verified request token. There is no application-side tenant filter anywhere, because there is nothing for one to protect.
- ✓One access predicate. Every policy calls the same function. One place to audit, one place to fix.
- ✓Hash-chained append-only audit log covering reads as well as writes. Tampering breaks the chain.
- ✓A continuous integration gate fails the build if anyone ships a table without tenant scoping or without a policy.
- ✓No training on customer data, contractually and technically. ABA Formal Opinion 512 attaches an informed-consent burden to self-learning tools; this removes it.
- ✓SOC 2 Type II is the gating requirement, not an aspiration — the architecture above is most of the control set.
- ✓Massachusetts 201 CMR 17.00 and the New York SHIELD Act bind us directly the moment one claimant has an address in those states. Built for, not bolted on.
- ✓Legal hold beats retention, through a single enforced check. FRCP 37(e) is not a policy document here; it is a function call.
Tenants that genuinely handle protected health information — typically defense-side work where the firm is a business associate — can turn on an elevated mode that adds field-level encryption, extended audit retention and an accounting-of-disclosures record. For a policyholder property practice that is normally unnecessary, and we would rather say so than sell you a compliance badge you do not need.
We are onboarding a small number of firms by hand.
Pilot firms get their jurisdictions verified first and shape what gets built next. Tell us where you practice and what you are running today.