Security and compliance.
Stated as it is.
Legal data is sensitive. This page explains how we protect it and where we stand on regulations and standards — without claiming more than we can show.
Six pillars
How we protect your data.
Data storage
Database, files and sign-ins are hosted by our infrastructure partner on AWS in London (United Kingdom), covered by an EU Commission adequacy decision. Payments and analytics are handled by providers that may process data in the USA; they are listed in our data processing agreement.
Encryption
TLS in transit and AES-256 at rest. Passwords are stored hashed and checked against known leaked passwords at sign-up.
Audit log
Changes to laws, judgments, users and billing data are logged with timestamp and actor.
Row-level access control
Database rules ensure a user can never read or change anyone else's documents, search history or conversations.
Export and deletion
Download or delete your personal data from your profile. Deletion requests are handled within 30 days.
No AI training on your data
Your documents, questions and contracts are never used to train AI models.
Status
Where we stand — regulations and standards.
Status per regulation and standard, kept up to date.
Regulation (EU) 2016/679 is applied: data processing agreement, access control, export and deletion.
Regulation (EU) 2024/1689. Our assessment: limited risk with transparency duties (Art. 50). Clear AI labelling, source requirements and human review.
Directive (EU) 2022/2555. We support customers in scope with audit logging, an incident process and supplier management.
Not certified. Our controls are aligned with ISO 27001 and certification work has started.
Not certified. AI governance is documented using the standard as a reference.
We do not have a SOC 2 report. Internal controls and policies are in place as preparation.
We will only use the word certified once an accredited body has issued a certificate.
Sub-processors
The list of sub-processors — which services process customer data, for what purpose and in which region — is part of our data processing agreement (DPA). Signed-in customers find it on the DPA page.
Read about the DPA and sub-processorsIncident response
If a security incident occurs, we follow a structured process to limit impact and report as required by law.
- 1Detection through monitoring of database, server functions and sign-in
- 2Internal analysis and isolation of affected components
- 3Notification of potentially affected users without undue delay
- 4Notification of the supervisory authority within 72 hours where GDPR Art. 33 requires it
Security incident? Contact us at security@legaldigm.se
Questions about security or compliance?
For procurements we provide our security whitepaper, data processing agreement and answers to security questionnaires on request.