Security

We implement a layered, defense-in-depth program across infrastructure, applications, and operations. This includes:

·       Encryption in transit (TLS 1.2) and at rest (AES-256).

·       Industry standard encryption at every layer in transit, at rest, and in use.

·       Role-based access controls and MFA for all privileged access.

·       Continuous monitoring, threat detection, and centralized logging.

·       Secure development practices with independent penetration testing.

·       Controls are verified through our SOC 2 Type 2 certification (audited by Sensiba) and aligned to ISO/IEC 27001.

Your data is hosted in AWS data centers matched to your jurisdiction. It does not leave your region without appropriate safeguards.

·       Australia & New Zealand: AWS Asia-Pacific (Sydney)

·       United Kingdom: AWS Europe (Dublin / London)

·       Ireland: AWS Europe (Dublin)

·       United States: AWS US regions

·       Canada: AWS Canada (Central)

For UK/EU clients, Standard Contractual Clauses (SCCs) are in place where required under UK/EU GDPR.

Yes. All client data is protected at every layer:

·       In transit: TLS 1.2 for all data moving between your devices and LEAP

·       At rest: AES-256 encryption for all stored data, including backups

Key management: Encryption keys managed via AWS KMS with strict access controls and regular rotation

Yes. Client data is logically segregated at both the application and data layers. Technical controls prevent any user from accessing data belonging to another firm. This segregation is independently verified through our regular penetration testing program.

Access is strictly controlled and audited:

·       LEAP staff access client data only when required to provide support, and only with appropriate authorization.

·       Privileged access is time-limited, monitored, and periodically reviewed.

·       MFA is enforced for all privileged access, being extended to all users.

·       All data access is logged for audit purposes.

·       SOC 2 Type 2 :  Certified (audited by Sensiba)

·       SOC 3 : Certified (audited by Sensiba)

·       ISO/IEC 27001:2022 : Aligned; formal certification in progress

·       GDPR / UK GDPR : Compliant; DPAs and SCCs in place

·       Australian Privacy Act : Compliant for AU/NZ operations

Reports and certificates are available via our Trust Center or upon request.

Yes. We undergo multiple forms of independent assurance:

·       Annual SOC 2 Type 2 audit by Sensiba

·       Regular penetration testing of applications and infrastructure

·       Internal audits against our ISO 27001-aligned ISMS controls at least annually

·       Summary penetration test findings are available via our Trust Center.

Our infrastructure is built for resilience:

• Deployed across multiple AWS availability zones within each region

• Active-active architecture for critical services

• Defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)

• Disaster recovery plans tested at least annually

• Encrypted backups stored in geographically separate zones within your data residency region

• Availability is a SOC 2 Trust Services Criterion (A1) included in our audit scope.

LEAP incorporates AI features (including Matter AI, Prompts, and AI time-tracking). Our commitments:

·       Your data is never used to train third-party AI foundation models without your explicit consent

·       AI features are designed for data minimization consistent with GDPR Article 25 and law firm professional obligations

·       Third-party AI vendors are contractually bound to the same data protection standards as all other sub-processors

·       AI-related security and privacy risks are assessed as part of our standard risk management process

Yes. We actively support client and prospect due diligence. We can provide:

·       SOC 2 Type 2 report (via Trust Center)

·       Penetration test summary findings (via Trust Center or on request)

·       Completed security questionnaires (SIG, CAIQ, and similar frameworks)

·       Data Processing Agreement (DPA) for GDPR purposes

·       Sub-processor register

·       Dedicated security contact for enterprise clients