Security

We implement a layered, defence-in-depth program across infrastructure, applications, and operations. This includes:

·       Encryption in transit (TLS 1.2) and at rest (AES-256)

·       Industry standard encryption at every layer in transit, at rest, and in use.

·       Role-based access controls and MFA for all privileged access.

·       Continuous monitoring, threat detection, and centralised logging.

·       Secure development practices with independent penetration testing.

·       Controls are verified through our SOC 2 Type II certification (audited by Sensiba) and aligned to ISO/IEC 27001.

Your data is hosted in AWS data centres matched to your jurisdiction, it does not leave your region without appropriate safeguards.

·       Australia & New Zealand: AWS Asia-Pacific (Sydney)

·       United Kingdom: AWS Europe (Dublin / London)

·       Ireland: AWS Europe (Dublin)

·       United States: AWS US regions

·       Canada: AWS Canada (Central)

For UK/EU clients, Standard Contractual Clauses (SCCs) are in place where required under UK/EU GDPR.

Yes. All client data is protected at every layer:

·       In transit: TLS 1.2 for all data moving between your devices and LEAP

·       At rest: AES-256 encryption for all stored data, including backups

Key management: Encryption keys managed via AWS KMS with strict access controls and regular rotation

Yes. Client data is logically segregated at both the application and data layers. Technical controls prevent any user from accessing data belonging to another firm. This segregation is independently verified through our regular penetration testing programme.

Access is strictly controlled and audited:

·       LEAP staff access client data only when required to provide support, and only with appropriate authorisation.

·       Privileged access is time-limited, monitored, and periodically reviewed.

·       MFA is enforced for all privileged access, being extended to all users.

·       All data access is logged for audit purposes.

·       SOC 2 Type II :  Certified (audited by Sensiba)

·       SOC 3 : Certified (audited by Sensiba)

·       ISO/IEC 27001:2022 : Aligned; formal certification in progress

·       GDPR / UK GDPR : Compliant; DPAs and SCCs in place

·       Australian Privacy Act :Compliant for AU/NZ operations

Reports and certificates are available via our Trust Centre or upon request

Yes. We undergo multiple forms of independent assurance:

·       Annual SOC 2 Type II audit by Sensiba

·       Regular Penetration testing of applications and infrastructure

·       Internal audits against our ISO 27001-aligned ISMS controls at least annually

·       Summary penetration test findings are available via our Trust Centre.

Our infrastructure is built for resilience:

• Deployed across multiple AWS availability zones within each region

• Active-active architecture for critical services

• Defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)

• Disaster recovery plans tested at least annually

• Encrypted backups stored in geographically separate zones within your data residency region

• Availability is a SOC 2 Trust Services Criterion (A1) included in our audit scope.

LEAP incorporates AI features (including Matter AI, Prompts, and AI time-tracking). Our commitments:

·       Your data is never used to train third-party AI foundation models without your explicit consent

·       AI features are designed for data minimisation consistent with GDPR Article 25 and law firm professional obligations

·       Third-party AI vendors are contractually bound to the same data protection standards as all other sub-processors

·       AI-related security and privacy risks are assessed as part of our standard risk management process

Yes. We actively support client and prospect due diligence. We can provide:

·       SOC 2 Type II report (via Trust Centre)

·       Penetration test summary findings (via Trust Centre or on request)

·       Completed security questionnaires (SIG, CAIQ, and similar frameworks)

·       Data Processing Agreement (DPA) for GDPR purposes

·       Sub-processor register

·       Dedicated security contact for enterprise clients