Microsoft Azure UK South for primary storage, AES-256 at rest via Azure Key Vault, TLS 1.3 in transit, role-based access under UK GDPR Art 28/32, and an append-only matter-level audit trail. The full posture — live controls and roadmap items — is set out below without spin.
Customer data is encrypted at rest with AES-256 via Azure Key Vault and in transit with TLS 1.3. Encryption is performed by Microsoft Azure managed services under their published attestations.
Databases, document storage and backups sit in Microsoft Azure UK South. AI processing today uses named sub-processors in the EU and US; where a jurisdiction is outside the UK/EEA we are actively executing ICO International Data Transfer Agreements (IDTAs) and publishing the signed Transfer Risk Assessments in our compliance pack. Until those IDTAs are complete, firms holding personal or client-privileged data should treat this as an in-progress control — the current status of each sub-processor is listed in the privacy notice below and refreshed weekly.
Three fully-shipped firm-facing access tiers (Admin, Solicitor, Staff). Client portal and Guest tier scaffolded today with the full client UI landing at public launch (1 Sep 2026). Four SRA compliance designations (COLP, COFA, Barrister, CILEX Legal Executive) on top — each wired into the permissions JWT and gated behind mandatory MFA. Per-matter confidentiality walls enforced at the database layer.
Every access, edit, AI generation, and supervising-solicitor approval is logged with a timestamp, actor and reason. Audit records are retained to the SRA's six-year minimum.
Under the Data (Use and Access) Act 2025, every AI-assisted output can be escalated to a human solicitor with a single click. Reviews are SLA-tracked and surfaced in the audit log.
A CREST-registered penetration test is scheduled before the first paid customer goes live. Remediation items and retest results will be published in the security changelog.
This grid shows every compliance programme we care about and its current status. Items marked In progress or Planned are not current certifications — we publish certificate references only once an accredited body has issued them.
Processing personal data in accordance with UK GDPR and the Data Protection Act 2018: lawfulness, data minimisation, purpose limitation, right to erasure, and data subject rights.
Registration of LawFuze AI Systems Ltd with the Information Commissioner's Office is in progress. The registration reference will be published here and in the footer once issued.
Cyber Essentials Plus v3.3 application is in progress. This certification requires hands-on technical verification including mandatory MFA, patch management and asset discipline.
Information security management system implementation is on the 2026 roadmap. No ISO 27001 certificate is in force today — any future certificate reference will be published on this page.
SOC 2 Type II is on our compliance roadmap. Planned reports are tracked internally; no attestation exists at present and nothing on this page should be read as an existing SOC 2 claim.
Five-firm closed beta · free until 1 September 2026. Client data stays in Azure UK South under UK GDPR with a matter-level audit trail.
Request beta accessSee It In Action
Walk through the key workflows — from your dashboard, in real time.