LawyerDeskBook a demo
Security and privacy

Built for confidential legal work.

How we protect your data, control access and support your team’s security review.

Request a security reviewRead the security policy

01 · Commitments

Our security commitments.

Alignment describes our controls. Ask us for current status and documentation.

  1. SOC 2 alignedControls mapped to the SOC 2 Trust Services Criteria. Roadmap on request.
  2. ISO 27001 alignedControls mapped to the ISO/IEC 27001 standard. Roadmap on request.
  3. DPDPData handling aligned to the DPDP Act 2023. Any record deleted on request.
  4. GDPR: DPA availableA data processing agreement for customers with EU data subjects.
  5. Data residency IndiaCustomer content is stored and processed in India.
  6. Encrypted in transit and at restAcross every service.

Model training

Never

Your documents and matters never train a shared or public model.

02 · Platform controls

The controls behind Case Trail.

Scoped to Case Trail. For LegiScore documentation, write to security@lawyerdesk.ai.

In transit
TLS 1.3Strict HSTS at a one-year max-age.
At rest
AES-256On the document vault. Backups use customer-isolated keys.
Retrieval boundary
Tenant scopedIndexed by tenant and case, so the Notebook cannot return another tenant’s matter.
Roles
3 rolesAt minimum: admin, member and view-only.
Sign-in
SMS OTPThe second factor after user ID and password.
Sessions
60 minOf inactivity ends a session.
Audit logs
1 year+Write once: every matter read and write, Notebook query and spend approval.
Production access
Ticket gatedJust in time and audited.
Incident response
30 minTo triage. Customers notified within 72 hours under DPDP.

03 · Your data

Your data, throughout its lifecycle.

  1. Collected

    Account details, the content you upload, anonymised usage metrics and access logs.

  2. Stored

    Encrypted at rest in India, inside your own tenant boundary.

  3. Used

    To run your workspace. Aggregated, non-identifying metrics improve reliability. Nothing else.

  4. Deleted

    Any record, any time. Matter content goes within 30 days of termination, unless law requires otherwise.

Asked by name

Four commitments.

Privilege

Matters are tenant-isolated, with least-privilege access and full audit logging. In Case Trail, the AI Court Notebook cites only the documents placed in that matter, so privileged material never leaves its boundary.

Training

No shared training, ever. Your documents and matters stay inside your tenant and serve only your workspace. We do not pool client data into a common model.

Transfers

Data residency is India by default, and we do not move your data across regions without your instruction. An instructed transfer relies on Standard Contractual Clauses and equivalent safeguards.

Your rights

Access, correct, delete, restrict or port your personal information, and object to certain processing. Write to privacy@lawyerdesk.ai and we respond within 30 days.

04 · Disclosure

Report a security concern.

Contact the security teamResponsible disclosure policy

  1. Where to report

    security@lawyerdesk.ai

    Send the detail and the steps to reproduce. The engineers who can fix it read it.

  2. First response

    1 business day

    A named owner and the triage outcome, then updates until the report is closed.

  3. Credit

    Credited

    Give us time to ship the fix before you publish, and test only your own tenant.

05 · Documents

Know who processes your data.

We notify customers at least 30 days before adding or replacing a sub-processor that handles customer content.

All legal documents

Have a security requirement?

Share your questionnaire or requirements with our team.

Contact security