Privacy-First Legal Aid Intake and Case Routing for NGO Legal Clinics
NGO legal clinics and university law clinics in Pakistan, India, Nigeria and Kenya take requests by phone, walk-in and WhatsApp, and sensitive details about domestic abuse, labour disputes or police cases end up in personal phones and spreadsheets. Build a secure intake system with a guided form, issue classification into a standard legal taxonomy, routing to the right volunteer lawyer, and strict access control, encryption and audit logs. Threat-model it before writing code.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 to 3 students
7 to ship
4 optional extrasSuggested stack
What you should ship
- A threat model covering abusive partners, leaked phones, curious insiders and data requests
- A guided intake form in English and one local language, with a quick exit button and minimal required fields
- Issue classification into a published legal issue taxonomy, with a human confirming every label
- Routing rules that assign cases by issue, language and availability
- Role-based access with row-level security, encryption of sensitive fields and audit logs
- A retention policy implemented in code: automatic deletion or anonymisation after a set period
- A security test report including automated scanning and manual checks
If you have time left
- Intake by voice note with transcription, kept on your own server
- A client portal for case updates with low-risk notifications
- Anonymised reports for donors
- A conflict-of-interest check before assigning a lawyer
The problem: sensitive stories in unsafe places
Legal aid clinics help people facing domestic violence, unpaid wages, wrongful dismissal, police harassment and property disputes. Requests arrive by phone, walk-in, email and WhatsApp. Volunteers write details in personal notebooks, phones and shared spreadsheets. If a phone is lost, or an abusive partner sees a message, the consequences can be serious. Cases also get stuck because nobody knows which lawyer should take them.
What already exists and the gap
- Legal aid case management systems exist in countries with funded legal aid, usually expensive or built for one country's rules.
- Docassemble and A2J Author power guided legal interviews but are not case management systems.
- General form and CRM tools are used informally without the access controls sensitive cases need.
The gap is a small, secure intake and routing system a clinic can run, designed around the threats its clients actually face.
Inspiration
The Learned Hands project, run by Stanford's Legal Design Lab and Suffolk University's Legal Innovation and Technology Lab, built a labelled set of people's legal questions and a legal issues taxonomy so that tools can route problems to the right help. Your project uses a published taxonomy for routing and adds the security design such tools need in places where clients may be at risk.
What you build
- People seeking help fill a short, calm form in their language with a quick exit button that leaves no trace on screen.
- Clinic coordinators review new cases, confirm the issue label and assign a volunteer lawyer.
- Volunteer lawyers see only their assigned cases.
The technically interesting part
- Threat modelling. Think about who might attack: an abuser checking a shared phone, an insider, a lost laptop, a data request. Design controls for each.
- Access control. Enforce row-level security in the database, not just in the interface, and test it.
- Encryption and retention. Encrypt sensitive fields, keep keys separate and delete data on schedule.
- Classification with a human in charge. A small classifier suggests an issue label from the description; a coordinator always confirms. Measure how often it is right.
How to evaluate it
- Security testing: automated scans plus manual tests of access control, with findings fixed and documented.
- Classification accuracy on a set of realistic, made-up requests.
- Routing time: from request to assignment in a role-play.
- Usability: completion time and clarity of the intake form.
Suggested plan
- Weeks 1 to 3: talk to a clinic, write the threat model, choose the taxonomy.
- Weeks 4 to 7: data model, access control and the intake form.
- Weeks 8 to 10: classification and routing.
- Weeks 11 to 13: encryption, retention and audit logs.
- Weeks 14 to 15: security testing, report and demo.
Path to a product
Legal aid NGOs, university law clinics, women's rights organisations and labour rights groups all need safer intake, often with donor funding for tools. A secure, open system with hosting support is a realistic offering. The project is strong evidence for application security roles.
Scope warning
Use only made-up cases in development and demos. Do not run it with real clients without the clinic's agreement, a data protection review and a plan for security updates. Do not give legal advice in the app.
Learn what you need on Sefism
- Cybersecurity roadmap: threat modelling, access control and testing.
- Backend roadmap: data model and routing.
- OWASP Application Security Verification Standard: requirements for the security design.
- OWASP Cheat Sheet Series: authentication, logging and encryption.
- PortSwigger Web Security Academy: testing your own app.
Get help with this idea
Security is easy to promise and hard to prove. Tauseef can help you write a threat model and test plan you can defend in your viva. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.