Security
How Legau handles security and data
Professional privilege doesn't end at your computer. At Legau, your clients' information is protected with the same rigor your profession demands of you: encrypted, isolated and never used to train models.
Infrastructure
Information security
Built to meet the duty of professional confidentiality you are bound by, not just to pass audits.
Data center
Microsoft Azure
- Your data stays in the US or the European Union, depending on your location
- Protection against attacks that try to take our services down
- Fire detection and suppression
- 24/7 physical monitoring and video surveillance
Web application firewall (WAF)
OWASP ModSecurity Core Rule Set
- Blocks attempts to access the database improperly
- Blocks the injection of malicious code into pages
- Blocks tampered requests used in attacks
- Stops attackers from using our servers to reach internal systems
- Detects and stops suspicious automated traffic (bots)
Encryption in transit
Always-secure connection
- All access goes over an encrypted connection (HTTPS)
- We always use the latest and most secure encryption protocols
- Browsers are forced to always use the secure connection (HSTS)
- Encrypted internal connections
Client documents
Isolated space per client
- Your documents are always encrypted, whether stored or in transfer
- Only our infrastructure has access to the files — never third parties
- Access keys are regularly rotated for security
Security by design
Engineering best practices
- Code is written to prevent the most common attacks
- Each team member only accesses what they need for their work
- Support for your company's single sign-on (SSO)
- System access restricted to authorized networks
Audit log
Complete access trail
- Every action is logged in an unalterable, tamper-proof way
- Stored separately, with configurable retention
- Sensitive data is automatically masked in the logs
- Lets you investigate access and demonstrate compliance
Data
Data handling principles
Minimal data collection
We store as little personal data as possible. Team members don't have access to data unless it is necessary for their work. All data is stored in the United States or Europe, depending on the client's jurisdiction.
View privacy policyYour data goes with you
If you leave, you can request complete removal of your personal data at any time, or export it in a readable format that other systems can use.
Never used to train models
Your clients' documents and data are never used to train AI models, ours or third parties', and serve only to provide you with the contracted service.
Operations
Operations and response
Continuous monitoring
- Metrics, logs and alerts 24/7
- Immediate notifications in case of anomalies
- Logging of all administrative access to servers
Backups and recovery
- Automatic database backups with 30-day retention
- Dedicated recovery environment, tested periodically
Vulnerability management
- Regular penetration tests (pentests) by external teams
- Every code change is automatically scanned for flaws
- Continuous monitoring of vulnerabilities in production
Try it for free
Join the thousands of lawyers who already work with Legau.