Security
LegalPunkt maintains the highest standards of security and data protection. We offer fully fine-grained access control, fully encrypted data in transit and at rest, full agent explainability, and a full log of actions. Most importantly, we never train our agents on user data.
Compliance Documents
Security Whitepaper
Detailed protocols, penetration test digests, and physical architecture guidelines.
Information Security Policy
Internal control policies, workforce screening rules, and access restriction details.
Architecture Diagram
Encrypted data routing diagrams, compartmentalization maps, and database isolates.
Your identity, your rules
LegalPunkt integrates directly with major enterprise Identity Providers (IDPs) such as Google Workspace, Microsoft Azure AD, Okta, and GitHub. This allows your security team to seamlessly enforce your corporate Single Sign-On (SSO) frameworks, apply Multi-Factor Authentication (MFA), and configure continuous session validity rules.
Granular access control
Configure attribute-based access control (ABAC), strict permission boundaries, and session governance to align precisely with your internal security policies and regulatory frameworks.
Adaptive Directory Sync (SCIM)
Keep your user registries automatically synchronized in real-time, so access states stay aligned whenever employees join, leave, or move across legal teams.
Encryption is where protection begins, not where it ends
LegalPunkt secures proprietary customer assets and sensitive contract schemas using advanced cryptographic protocols. Customer secrets are isolated in high-availability vaults with dedicated hardware security modules, and processed data is anonymized throughout the pipeline.
Certified and compliant
Operational systems, legal playbooks, and data structures are audited against strict compliance frameworks with full forensic traceability across user sessions.
Zero-Knowledge AI Engine
After playbook review, parsing, or generation is complete, session cache states are purged. Client data is not retained for subsequent model training.
Protected Infrastructure (Cloud SaaS)
Our managed environment offers automated updates and scaling, with deployment flexibility for sovereignty requirements. Whether multi-tenant cloud, isolated single-tenant cloud, or private network deployment, LegalPunkt keeps workspace boundaries and controls immutable.
Single Tenant
Dedicated private instances deployed on isolated cloud clusters with strict schema isolation and zero co-mingling of workspace data.
On-Premises VPC
Install in your environment
Run protected software containers in your private network or firewall perimeter to retain full physical custody over operational contexts.
Live Environment Monitoring
All Systems OperationalAccess Security
Encryption-in-Transit
Service data transmitted over the internet is encrypted-in-transit.
Asset Inventory
A list of system assets, components, and respective owners are maintained and reviewed at least annually.
User Access Reviews
System owners conduct scheduled user access reviews of production servers, databases, and applications to validate internal user access is commensurate with job responsibilities.
Network Security
Logging and Monitoring for Threats
Logging and monitoring software is used to collect data from infrastructure to detect potential security threats, unusual system activity, and monitor system performance, as applicable.
Automated Alerting for Security Events
Alerting software is used to notify impacted teams of potential security events.
Network Security Policy
A Network Security Policy identifies the requirements for protecting information and systems within and across networks.
Confidentiality
Data Retention and Disposal Policy
A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.
Access to Customer Data is Restricted
Access to, erasure of, or destruction of customer data is restricted to personnel that need access based on the principle of least privilege.
Data Classification Policy
A Data Classification Policy details the security and handling protocols for sensitive data.
Availability
Business Continuity and Disaster Recovery Policy
Business Continuity and Disaster Recovery Policy governs required processes for restoring the service or supporting infrastructure after suffering a disaster or disruption.
Backup Restoration Testing
Backed-up data is restored to a non-production environment at least annually to validate the integrity of backups.
Testing the Business Continuity and Disaster Recovery Plan
The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Business Continuity and Disaster Recovery Plan based on the test results.
Vulnerability Management
Vulnerability Scanning
Vulnerability scanning is performed on production infrastructure systems, and identified deficiencies are remediated on a timely basis.
Third-Party Penetration Test
A 3rd party is engaged to conduct a network and application penetration test of the production environment at least annually. Critical and high-risk findings are tracked through resolution.
Vulnerability and Patch Management Policy
A Vulnerability Management and Patch Management Policy outlines the processes to efficiently respond to identified vulnerabilities.
Change Management
Configuration and Asset Management Policy
A Configuration and Asset Management Policy governs configurations for new sensitive systems.
Approval for System Changes
System changes are approved by at least 1 independent person prior to deployment into production.
Production Data Use is Restricted
Production data is not used in the development and testing environments, unless required for debugging customer issues.
Incident Response
Lessons Learned
After any identified security incident has been resolved, management provides a 'Lessons Learned' document to the team in order to continually improve security and operations.
Incident Response Plan Testing
The Incident Response Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Incident Response Plan based on the test results.
Tracking a Security Incident
Identified incidents are documented, tracked, and analyzed according to the Incident Response Plan.
Organizational Management
Roles and Responsibilities
Information security roles and responsibilities are outlined for personnel responsible for the security, availability, and confidentiality of the system.
New Hire Screening
Hiring managers screen new hires or internal transfers to assess their qualifications, experience, and competency to fulfill their responsibilities. New hires sign confidentiality agreements or equivalents upon hire.
Advisor Meetings on Security
Senior management and/or board of directors meets at least annually to review business goals, company initiatives, resource needs, risk management activities, and other internal/external matters. The information security team meets at least annually to discuss security risks, roles & responsibilities, controls, changes, audit results and/or other matters as necessary.
Risk Assessment
Risk Assessment
Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.
Risk Assessment and Treatment Policy
A Risk Assessment and Treatment Policy governs the process for conducting risk assessments to account for threats, vulnerabilities, likelihood, and impact with respect to assets, team members, customers, vendors, suppliers, and partners. Risk tolerance and strategies are also defined in the policy.
Vendor Risk Management Policy
A Vendor Risk Management Policy defines a framework for the onboarding and management of the vendor relationship lifecycle.
Physical Security
Physical Access Reviews
Processes are in place to periodically review physical access to ensure consistency with job responsibilities.
Physical Security Policy
A Physical Security Policy that details physical security requirements for the company facilities is in place.
Have questions?
Ask about our security practices, compliance, or deployment options — our AI will find the right guides.