Trust & Security
Legal matters are sensitive. Here is exactly how we protect your data, respect your privacy, and keep everything secure.
SOC 2 Type II
Security & Availability
We are actively working toward SOC 2 Type II certification against the AICPA Trust Services Criteria, covering security, availability, and confidentiality. Our controls are aligned with the standard.
ISO/IEC 27001
Information Security
We align with the world's leading information security management standard, ensuring systematic controls over data access, risk, and incident response.
ISO/IEC 42001
AI Management
We follow the international standard for responsible AI governance, ensuring our AI systems are transparent, accountable, and built with documented safeguards.
GDPR
Data Protection
We comply with the EU General Data Protection Regulation. EU residents can exercise their rights (access, rectification, erasure, portability) at any time.
CCPA
Privacy
California residents have the right to know what personal data we collect and to request deletion. Contact us at [email protected].
PCI DSS
Payment Security
All payment processing is handled by Dodo Payments, a PCI DSS compliant provider. We never handle or store raw card data on our servers.
Data Protection
Encryption at rest
All stored data is encrypted using AES-256.
Encryption in transit
All connections are protected with TLS 1.3.
Tenant data isolation
Each account's data is logically isolated. Cross-tenant access is architecturally impossible.
Automated backups
Daily backups with point-in-time recovery, encrypted and stored redundantly.
Data deletion on request
Users can request full deletion of their data at any time.
Data residency controls
Choose which region your data is stored in.
Access & Authentication
Role-based access control
Internal access to production systems is role-based and logged.
Multi-factor authentication (MFA)
MFA is enforced for all internal team members.
Session management
Sessions expire automatically and can be revoked by the user.
Single Sign-On (SSO)
Log in via your organisation's identity provider (SAML/OIDC).
Hardware security keys
Support for FIDO2/WebAuthn physical keys.
AI & Privacy
No AI training on your data
Queries and documents are never used to train or fine-tune AI models.
Query anonymization
Personally identifying context is stripped before processing.
AI output audit trail
Every AI response is logged with its source references.
Private AI deployment
Dedicated AI instance isolated from other customers.
Infrastructure & Monitoring
DDoS protection
Network-level protection against denial-of-service attacks.
Vulnerability scanning
Automated scans run continuously on our infrastructure.
Penetration testing
Annual third-party penetration test of our systems.
24/7 security monitoring (SIEM)
Continuous log aggregation and anomaly alerting.
Bug bounty program
Public program rewarding responsible vulnerability disclosure.
Incident Management
Incident response plan
A documented, regularly tested plan for security incidents.
Breach notification (72 h)
Affected users are notified within 72 hours of a confirmed breach.
Audit logs
Full access and change logs available to Business plan users.
These are the sub-processors we use to operate TheLawGPT. Each is vetted for security and bound by data protection agreements.
To request a Data Processing Agreement (DPA), contact [email protected].