Is this your company? Buyers are checking Legl here. Claim legl.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Legl
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Legl is SOC 2 compliant. Legl also holds ISO 27001, GDPR, and PCI DSS.
About
Legl is an intelligent risk, compliance, and payments platform trusted by 400+ UK law firms, including 40 of the Top 200. Its award-winning technology empowers legal teams to streamline compliance, risk management, and payments. As the only fully integrated solution in the market, Legl enables firms to onboard clients, conduct KYC, KYB, AML, and source of funds checks, monitor ongoing risk, and collect payments. With Legl, fee-earners start billable work sooner, collect revenue faster, and deliver exceptional digital-first client experience. Legl enables law firms and other regulated businesse
Compliance & infrastructure
Hosting
AWS
Subprocessors
13- EEntrust Identity · Data analytics
- HHeroku · Cloud provider
- AAmazon Web Services · Cloud provider
- GGoogle LLC · Cloud provider
- AAdyen · Finance and payments
- VVolt Technologies · Finance & Payments
- IIVXS UK Ltd t/a ComplyAdvantage · Cloud monitoring
- DDatadog · Cloud monitoring
- EEquifax Ltd · Identity provider
- TTrueLayer · Finance and payments
- Dun & Bradstreet · Business data solution
- AActiveCampaign LLC (Postmark) · Email service provider
Show all 13 subprocessorsShow fewer
- FFrankie One · Data analytics
Compliance leadership
The person who leads Legl's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Legl's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Legl SOC 2 compliant?
Legl is SOC 2 compliant. On SOC2C this listing is Listed.
Is Legl ISO 27001 certified?
According to Legl's public trust center, Legl is ISO 27001 certified. On SOC2C this listing is Listed.
Is Legl GDPR compliant?
According to Legl's public trust center, Legl is GDPR compliant. On SOC2C this listing is Listed.
Is Legl PCI DSS compliant?
According to Legl's public trust center, Legl is PCI DSS compliant. On SOC2C this listing is Listed.
Can I use Legl's SOC 2 for a vendor risk assessment?
Yes. Legl's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Legl penetration tested?
Legl hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Legl secure?
Security isn't a single yes/no, but Legl is SOC 2 compliant and holds ISO 27001, GDPR, PCI DSS. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Legl have a bug bounty or vulnerability disclosure program?
Legl hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@legl.com or via a /security page (Legl lists a security contact).
Who are Legl's subprocessors?
Legl lists 13 subprocessors on its trust center, including Entrust Identity, Heroku, Amazon Web Services, Google LLC
, Adyen. Buyers use this for fourth-party risk review.
Where does Legl host or store data?
Legl hosts on AWS. Data residency details are on its trust center.
Where is Legl's trust center or security page?
Legl's trust center is at https://trust.legl.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Legl
Reproduced from Legl's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Is Legl ISO 27001 certified?
Yes, Legl is ISO 27001:2022 certified, meaning we adhere to internationally recognised standards for information security management. Our certification is maintained through annual external audits to ensure our security controls remain robust and effective.
Is Legl GDPR compliant?
Legl is GDPR compliant. The company has robust policies and controls in place to ensure data protection, privacy, and security in line with GDPR requirements.
How does Legl ensure data security?
Legl implements a multi-layered security approach, including AES-256 encryption for data at rest, TLS 1.2+ for secure data transmission, and Multi-Factor Authentication (MFA) for access controls. We also conduct regular security audits, penetration testing, and continuous threat monitoring to proactively detect and mitigate risks.
Where is Legl’s data stored?
Legl's data is securely stored on AWS data centers located in Dublin, Ireland. AWS maintains industry-leading security certifications, including ISO 27001 and SOC 2, ensuring the highest levels of physical and operational security for data hosting.
Does Legl use third-party subprocessors?
Yes, Legl works with trusted third-party subprocessors, they can be found in subprocessor policy - https://legl.com/sub-processors
How are payments processed through Legl?
Legl partners with FCA-regulated payment providers, including Adyen, and Volt Technologies Holdings Limited , to ensure secure and compliant payment processing. Strong Customer Authentication (SCA) is enforced for transactions, and payment data is never stored by Legl.
What guardrails are used to manage GenAI?
Legl uses Generative AI in a controlled and secure manner to support product functionality. The following safeguards are in place: - No model training with customer data: we do not use any customer or end user data to train or fine-tune AI models. - No automated decision-making: outputs from Generative AI are used to assist users, not to make automated decisions. - Trusted sub-processors: we use established providers, such as Microsoft, who are certified under internationally recognised standards including ISO 27001 and SOC 2. - Strong encryption: all data is encrypted in transit and at rest using modern encryption protocols. - Full application of existing controls: all of Legl’s existing data protection measures apply, including data minimisation, role-based access control, processing within the EU/UK, and secure retention and deletion practices. These controls ensure that our use of AI aligns with our ISO 27001-certified Information Security Management System and applicable data protection legislation.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public