Encryption
TLS for every connection. Files at rest encrypted with AES-256-GCM using a key per firm — Litora-managed, the firm's own key, or the firm's AWS KMS key (BYOK). Crypto-shredding on request.
§ Trust
Trust centre
How client material is protected, who else processes it, and exactly where our certifications stand.
§ 01 · Controls
How client material is protected
Access control
Roles for every seat, two-factor sign-in (can be required firm-wide), Google and Microsoft single sign-on, IP allowlists, idle and maximum session limits.
Isolation
Every record is scoped to the firm that owns it. Client-portal users have separate accounts and see only the matters opened to them.
Audit trail
Every sign-in, upload, AI run, export, share, deletion and security change is logged with who, when and from where — viewable and exportable by the firm's admin.
Retention and deletion
Firms set their own retention periods; deleting a matter erases its files from disk. Deletion of the encryption key makes encrypted files unreadable.
AI use
The AI provider does not train on customer data. Outputs cite the documents they rely on, authorities are verified against official sources or flagged, and every output is for a qualified lawyer to check.
§ 02 · Certification
Where we stand
We state our status plainly. "Preparing" means the controls are built and documented but the independent audit has not yet taken place.
| Framework | Status | Detail |
|---|---|---|
| UK GDPR / Data Protection Act 2018 | Compliance programme in place | Records of processing, DPIA, DPA and data subject rights processes. |
| ISO/IEC 27001:2022 | Preparing for certification | Controls implemented in the product; independent audit not yet carried out. |
| SOC 2 Type II | Preparing | Controls mapped to the Trust Services Criteria; observation period not yet started. |
| ISO/IEC 42001:2023 (AI management) | Preparing | AI policy, impact assessment and human-review controls in place. |
§ 03 · Sub-processors
Who else processes data
| Sub-processor | Purpose | Location | Notes |
|---|---|---|---|
| Anthropic PBC | AI model provider (reading, analysis, drafting) | United States | Data is not used to train models; commercial terms. |
| Hostinger International Ltd | Web hosting, database, file storage and email | European Union | Data centre as configured for the account. |
| Google LLC (Firebase) | Mobile number verification codes | United States | Only the phone number and verification code. |
| Amazon Web Services | Key management — only for firms that choose their own AWS KMS key | The firm's chosen AWS region | The firm's own AWS account. |
Transfers outside the UK rely on the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework, as applicable. We give customers notice before adding a sub-processor.
Documents and contacts
A Data Processing Agreement, our security overview and the completed security questionnaire are available to customers on request from privacy@litorauk.com.
Report a vulnerability to security@litorauk.com (see security.txt). We acknowledge reports within two working days and do not take action against good-faith research.