Encryption
- TLS 1.3 in transit, HSTS preload, modern cipher suites only.
- AWS KMS SSE-KMS at rest for paid dossiers and uploaded evidence.
- Customer-segregated S3 prefixes; never a shared bucket key.
Trust
Security overview
Technical and organizational measures protecting LegalAudit infrastructure and customer evidence.
Audit chain
- SHA-256 hash-chained WORM audit log for every relevant action.
- Automated verification on /api/ready; tamper alerts to on-call.
- Admin operators sign actions via authenticated sessions.
Application security
- Strict Content-Security-Policy with nonced scripts, enforced in production.
- ClamAV pre-scan of every upload; archives extracted in a bwrap sandbox.
- SSRF guard on every outbound URL fetch (DNS pinning, IP allowlists).
- Server-side rate limiting per tenant/user and per IP.
Identity & access
- MFA enforced for all staff with production access.
- Role-based access control, quarterly access reviews.
- Secrets stored in a managed secret store; rotated on incident.
Resilience
- Daily encrypted database backups, point-in-time recovery enabled.
- Redis-backed queue with ack/visibility semantics and dead-letter queue.
- Health and readiness probes for DB, Redis, S3, LLM, and audit chain.
Testing
- External penetration test commissioned for Q4 2026 (report on request once issued).
- Continuous dependency scanning and CSP report monitoring.
- Internal red-team exercises focused on prompt injection and data exfiltration.
Coordinated disclosure
Report vulnerabilities to security@legalaudit.ch. We acknowledge within 24 hours and triage within 72 hours. PGP key fingerprint: PGP key on request — placeholder until publication of the official key block.
Informational document published by LegalAudit SA. Statements reflect the current state of controls and are reviewed quarterly. They are not a contractual warranty unless incorporated into a signed agreement. For binding terms request the executed DPA at privacy@legalaudit.ch.