Where We Stand
Most trust pages are wallpaper. This one is a status board: what’s live, what’s being built, and what comes next. Each item says exactly what it is, because the security teams reading it know the difference.
In place and operating now.
Every email sent from legalancer.com is authenticated with SPF, DKIM, and DMARC at full enforcement (p=reject). Receiving mail servers are told to reject anything that claims to be from Legalancer and isn’t.
Our security program is mapped to the NIST Cybersecurity Framework 2.0 in a written organizational profile: where we stand on every outcome, where we’re headed, and the plan to get there. AI features are assessed against the NIST AI Risk Management Framework.
We honor Texas (TDPSA) and California (CCPA/CPRA) privacy rights: access, correction, and deletion on request. Requests about records inside the platform are handled together with the agency that controls them. We don’t sell personal data, and client data stays in the United States.
Being implemented and documented now.
We’re working through the Minimum Viable Secure Product (v3) baseline, the checklist enterprise security teams use to screen the vendors they let near their data. Annual third-party penetration testing is already in place.
We’re building our program around the HIPAA Security Rule: a formal risk analysis, workforce training, access controls, and Business Associate Agreements with the vendors that handle client content. Customer BAAs come with it.
Card payments happen entirely on the payment processor’s secure hosted pages, so card details never touch Legalancer’s systems. We’re documenting our PCI DSS responsibilities, including a responsibility statement for agencies that take card payments through the platform.
We’re completing the Consensus Assessments Initiative Questionnaire (CAIQ v4) for publication in the Cloud Security Alliance’s public STAR registry.
On the roadmap. These take outside auditors, time, and budget.
SOC 2 is an audit, not a checklist: an independent CPA firm examines our controls over a multi-month window. It’s on our roadmap.
Day to Day
TLS on every connection, AES-256 on every stored file and database, and an extra layer of application-level encryption on the most sensitive fields.
MFA is turned on for every staff account and available to every user.
Customers, contractors, and staff each work in their own portal. Every request re-checks role and ownership on the server, not just in the interface.
Actions on a job are written to an activity log: who did what, and when.
All data is hosted in U.S. cloud regions. Nothing is hosted outside the country.
File-share links are stored only as one-way hashes, expire on their own, and are revoked automatically when an order is canceled or an account is archived.
Dependencies are audited and critical patches come first. An independent penetration test runs every year.
We’re finalizing a written response plan with named roles, customer notification commitments, and documented recovery steps.
Staff see only what their role requires, and destructive operations are limited to administrators and managers.
AI, Governed
Legalancer’s AI runs on our own private instance inside Legalancer’s environment. Documents never go to an outside AI service, and nothing it reads trains a model.
It’s the role NCRA’s COPE guidance gives AI in this profession: strictly assistive, never a substitute for the certified professional.
Talk to Us
We welcome good-faith security research. Report a vulnerability and we’ll acknowledge it within two business days. We won’t pursue legal action over research done in good faith, which means not accessing data that isn’t yours and not disrupting the service. Security questionnaires and BAA requests go to the same address.
Statuses on this page are kept current as our program evolves. “Active” marks a control or self-assessment in operation today, “In Progress” marks one being implemented now, and “Planned” marks work on the roadmap.