Trust and Security | LegalOperator

Where we are on SOC 2

SOC 2 Type II: audit in progress

SOC 2 Type II: audit in progress. Our controls are being audited by an independent firm and we are in the observation period now. We expect the Type II report in November 2026. A third-party penetration test was completed in July 2026 and all findings were remediated. We can share the pen test summary and our audit timeline under NDA today, and the full report when it is issued.

In place today

What is in place today

Every line below is live.

Encryption. Data is encrypted in transit (TLS 1.2 or higher) and at rest.
Hosting. DigitalOcean, US West region. Managed database, application servers and file storage all on DigitalOcean.
Tenant isolation. Every record is tagged to one customer and every data access is forced through a tenant-scoped layer. Uploaded files are separated by customer in object storage.
Role-based access. Five roles (user, expert, admin, super admin, support). Access is checked server-side on every request.
Restricted matters. Sensitive matters can be sealed so only named people can see them, and Iris respects those seals.
Password security. Passwords are hashed with Argon2id, checked against breached-password databases, and password reset, invite and change actions are rate-limited.
Logging and reviews. Access is logged and we run regular security reviews. Hardening from the July 2026 penetration test is shipped.
Secure build pipeline. Automated secret scanning and a software bill of materials on every build.
Backups. Automated daily backups with 7-day point-in-time recovery, copied to a second region, with restore tests.
Incident response. Documented incident response policy (v1.0, June 2026): 24/7 production monitoring, triage, containment, recovery and postmortem, owned by our Security Officer.
Staff access. Access to customer data by our team is limited to the founders, used only for support and operating the service, and follows least privilege. Our own critical services require MFA.
Deletion on request. We fully delete a customer on request: files removed from storage and a hard delete cascaded through every related table.
Data Processing Addendum. A DPA is available and referenced in our privacy policy.
Continuously monitored. 50+ controls across access, data protection, disaster recovery, endpoint, infrastructure, vendor and vulnerability management are monitored by Oneleet and published on our Trust Center.

AI and your data

How AI handles your data

Your data does not train AI models. Not ours, not OpenAI's. Our privacy policy and our agreement with OpenAI both say so.
One AI provider. All AI features run through OpenAI's API under a signed Data Processing Addendum. No other model provider is active.
Retention at OpenAI. OpenAI may retain prompts and answers for up to 30 days for abuse monitoring, then deletes them. They are never used for training. We are moving to zero retention.
Answers come only from your content. Iris and the front door answer from your uploaded policies, playbooks and approved answers, never from the open internet.
Analytics do not see your content. Product analytics capture usage metadata only (timing, counts). The text of questions and answers is excluded by default.
Human in the loop where it matters. Anything Iris changes runs through a preview-and-confirm step. Knowledge capture can be automatic or reviewed by a lawyer first, your choice.

Subprocessors

Who else touches your data

We notify customers before adding or changing a subprocessor.

Subprocessor	Purpose	Data handled
OpenAI	AI answers and search embeddings	Prompts and generated answers; not used for training; DPA in place
DigitalOcean	Hosting, managed database, background workers, file storage (US West)	Customer application data and uploaded files at rest
PostHog	Product analytics	Usage metadata only; content excluded
Customer-connected sources (optional)	Knowledge import and chat channels, only when you connect them	Only the data you choose to connect: Google Drive, SharePoint, Notion, Slack, Teams, Zoom Chat, Jira

See every live connection on our Integrations page.

Planned

What is planned

Stated so reviewers can see the direction. Dates appear only where we have committed to one.

SOC 2 Type II report: expected November 2026.
Single sign-on (SAML) for customer logins: planned.
Multi-factor authentication for customer logins: planned.
Customer-controlled staff access, where you invite our team into your workspace rather than access being assumed: planned.
Breach notification: if a security incident affects your data, we notify you without undue delay, as set out in our DPA.

Common questions

Is LegalOperator SOC 2 certified?

Not yet. Our SOC 2 Type II audit is in progress with an independent firm, we are in the observation period, and we expect the report in November 2026. A third-party penetration test was completed in July 2026 with all findings remediated. We share the pen test summary and audit timeline under NDA and will post the report on our Trust Center when issued.

Does LegalOperator use my data to train AI?

No. Customer data is never used to train our models or OpenAI's models. Our privacy policy states it and our Data Processing Addendum with OpenAI prohibits it. Iris and the front door answer only from your own uploaded policies, playbooks and approved answers, never from the open internet.

Where is my data stored and who can see it?

Data is hosted on DigitalOcean in the US West region, encrypted in transit and at rest, and isolated per customer at the data layer. Inside your workspace, role-based access and sealed restricted matters control who sees what. Our staff access is limited to the founders, for support only.

Can I delete my data?

Yes. On request we fully delete a customer: files are removed from storage and a hard delete is cascaded through every related table. Retention during your subscription follows your own configuration, and data is deleted or returned at termination under our DPA.

Will you complete our security questionnaire and sign a DPA?

Yes to both. Email security@legaloperator.ai. We answer questionnaires directly, sign NDAs, provide our DPA, and share the penetration test summary and SOC 2 timeline. Our live Trust Center at trust.oneleet.com/legal-operator lists every monitored control.

Security questions? Ask us directly.

Questionnaires, NDAs, the DPA, the pen test summary and the SOC 2 timeline. One email, a direct answer.

Email security@legaloperator.ai Open the Trust Center ›