Legl

Legl hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Legl is SOC 2 compliant and holds ISO 27001, GDPR, PCI DSS. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Legl hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@legl.com or via a /security page (Legl lists a security contact).

Legl lists 13 subprocessors on its trust center, including Entrust Identity, Heroku, Amazon Web Services, Google LLC , Adyen. Buyers use this for fourth-party risk review.

Legl hosts on AWS. Data residency details are on its trust center.

Legl's trust center is at https://trust.legl.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes, Legl is ISO 27001:2022 certified, meaning we adhere to internationally recognised standards for information security management. Our certification is maintained through annual external audits to ensure our security controls remain robust and effective.

Legl is GDPR compliant. The company has robust policies and controls in place to ensure data protection, privacy, and security in line with GDPR requirements.

Legl implements a multi-layered security approach, including AES-256 encryption for data at rest, TLS 1.2+ for secure data transmission, and Multi-Factor Authentication (MFA) for access controls. We also conduct regular security audits, penetration testing, and continuous threat monitoring to proactively detect and mitigate risks.

Legl's data is securely stored on AWS data centers located in Dublin, Ireland. AWS maintains industry-leading security certifications, including ISO 27001 and SOC 2, ensuring the highest levels of physical and operational security for data hosting.

Yes, Legl works with trusted third-party subprocessors, they can be found in subprocessor policy - https://legl.com/sub-processors

Legl partners with FCA-regulated payment providers, including Adyen, and Volt Technologies Holdings Limited , to ensure secure and compliant payment processing. Strong Customer Authentication (SCA) is enforced for transactions, and payment data is never stored by Legl.

Legl uses Generative AI in a controlled and secure manner to support product functionality. The following safeguards are in place: - No model training with customer data: we do not use any customer or end user data to train or fine-tune AI models. - No automated decision-making: outputs from Generative AI are used to assist users, not to make automated decisions. - Trusted sub-processors: we use established providers, such as Microsoft, who are certified under internationally recognised standards including ISO 27001 and SOC 2. - Strong encryption: all data is encrypted in transit and at rest using modern encryption protocols. - Full application of existing controls: all of Legl’s existing data protection measures apply, including data minimisation, role-based access control, processing within the EU/UK, and secure retention and deletion practices. These controls ensure that our use of AI aligns with our ISO 27001-certified Information Security Management System and applicable data protection legislation.