Why it matters
Migration practices handle passports, financial records, health documents, and other files that create real harm if exposed.
Security
Your clients' data deserves verified security.
Matter holds CASA Tier 3 certification. An independent, authorised security lab manually tested the application across all 14 OWASP ASVS categories.
What makes Matter secure?
Matter offers a 99.99% uptime SLA. Migration practices handle highly sensitive client records. Matter holds CASA Tier 3 certification, which means an authorised security lab manually tested the application across all 14 OWASP ASVS categories.
What to look for
Claims like "SSL" and "cloud hosting" are table stakes. They do not prove the application was tested for vulnerabilities.
What Matter proves
Matter holds CASA Tier 3, which requires manual penetration testing by an authorised security lab across the OWASP ASVS.
CASA Tier 3
What CASA Tier 3 actually means.
The Cloud Application Security Assessment was developed by the App Defense Alliance, a coalition led by Google, Meta, and Microsoft, and it is built on the OWASP Application Security Verification Standard (ASVS), a widely used standard for testing how securely an application is actually built.
CASA has three tiers. They are not the same thing.
1
Tier 1: Self-assessment
The developer fills out a questionnaire about their own security practices.
2
Tier 2: Automated scanning
An automated tool scans the application for known vulnerabilities. Better than self-assessment, but limited to what scanners can detect.
3
Tier 3: Independent manual penetration testing
An authorised security lab manually tests the application across all 14 OWASP ASVS categories, including authentication, session management, access control, cryptography, and error handling.
Matter holds Tier 3. Recertified annually. Each assessment produces a formal Letter of Validation from the authorised lab.
CASA Tier 3 vs ISO 27001. Different things.
ISO 27001 certifies your security processes: it says your organisation keeps policies for managing information security, from access reviews to incident response plans to risk registers, but it never tests whether the application itself has vulnerabilities.
CASA Tier 3 certifies the actual application. A security lab sat down and tried to break it, methodically, across 14 categories of known attack vectors.
They are complementary. One certifies the organisation. The other certifies the code.
Engineering
Built by engineers who ran cloud software at Atlassian, one of the world's largest software companies.
Matter’s founders have 40+ years of combined experience building and operating enterprise software at global scale, including at Atlassian. That experience shapes how Matter is designed, reviewed, and operated. Threat modelling, secure code review, practice isolation, and independent testing are part of how the team works.
Technical details
Under the hood.
Encryption at rest and in transit
All data is encrypted with AES-256 while it sits at rest, and every single connection to the application runs over TLS 1.3. No exceptions.
Practice isolation
Every migration agency gets an isolated practice. Your data is separated from other agencies at the infrastructure level, not just the application level.
Role-based access controls
Staff members see only what their job requires, principals decide who gets access to what, and permissions stay granular per role. Nothing is shared by default.
Audit logging
Every action recorded with timestamps and attribution. If OMARA asks who accessed a file and when, you have the answer.
No client data in AI training
Matter uses AI features to automate routine work, but your clients' data is never handed to a model as training material. Full stop.
Security FAQ
Common questions
Direct answers for firms evaluating Matter's security.
Does Matter offer an uptime SLA?
Yes. Matter offers a 99.99% uptime SLA.
See MatterCan we keep a backup in storage our practice owns?
Yes. Matter supports backup to your own Google Drive or OneDrive. Keep a copy of practice records in storage you control alongside Matter’s connected case workflow.
See Matter’s capabilitiesWhat is CASA Tier 3 certification?
CASA Tier 3 is the highest tier of the Cloud Application Security Assessment, developed by the App Defense Alliance. It requires independent manual penetration testing across all 14 categories of the OWASP Application Security Verification Standard.
See the breakdownHow does CASA Tier 3 differ from ISO 27001?
ISO 27001 certifies how an organisation manages security. CASA Tier 3 verifies that the actual application was independently tested for security flaws. They are complementary, but they are not the same thing.
Compare the twoHow does Matter protect client records day to day?
Matter combines encryption at rest and in transit, isolated practices, role-based access controls, and audit logging so firms can control access and trace activity when needed.
See technical controlsIs client data used to train AI models?
No. Matter can use AI features for automation, but client data is not used to train models.
See AI handlingRelated pages
See how security shows up across Matter.
Matter overview
See how the portal, record, and automation layers fit together in the full product.
Open pageAgent portal
See how your team handles requests, notes, history, and updates on the file itself.
Open pageClient portal
See where clients upload documents, track progress, and read your updates.
Open pageCompare migration software
Review the comparison pages if you are weighing Matter against other migration products.
Open page