Security
Your contracts stay yours
Contracts hold your clients' and your company's most sensitive information. OneLegal is built so that confidentiality is the default, not a setting.
How we protect your data
Never used for training
Your contracts, prompts and outputs are never used to train or fine-tune any model, by Oltin or by our AI providers. This is written into our data processing terms.
No retention by AI providers
We only use AI providers that agree not to keep your prompts or outputs.
Your data stays in your region
UK customers in the UK and Indian customers in India: documents, search indexes, backups, logs and AI processing.
Encrypted everywhere
TLS 1.2 or later for everything in transit and AES-256 for everything at rest. Chat messages and documents are sealed again with each organisation’s own key, and calls are encrypted end to end and never recorded.
Ethical walls
Matters keep client work apart. People only see the matters they are on, enforced at the data layer, not just in the screens.
Audit logs
Every change by a member or an admin is recorded and cannot be edited, so you can show auditors and your DPO who did what.
Strong sign-in
Single sign-on, SCIM provisioning and multi-factor policies for your organisation.
Safe with untrusted documents
Text inside a contract is treated as untrusted. OneLegal will not follow instructions hidden in a document to act outside it.
Accessible to everyone
Built to WCAG 2.2 AA: keyboard-only use, screen-reader labels, and risk shown with an icon and a word, never colour alone.
Certifications
We will not claim a certificate before we have it. Here is our plan.
- SOC 2 Type I and ISO 27001Planned
- Independent penetration testsPlanned, with summaries on request
- SOC 2 Type II reportPlanned
- ISO 42001 (AI management) and ISO 27701 (privacy)Planned
Laws and guidance we build for
- Digital Personal Data Protection Act 2023 and Rules 2025 (India), acting as your data processor
- UK GDPR and the Data (Use and Access) Act 2025
- IT Act 2000, Electronic Signature Rules 2015 and the Stamp Acts, through the India pack
- SRA and Law Society guidance on confidentiality and verifying AI output
- The Supreme Court of India's position on unverified AI citations
Security review or a vulnerability to report?
Ask for our security questionnaire answers, data processing terms or architecture overview. If you think you have found a vulnerability, tell us and we will reply quickly.
See OneLegal on your own contracts
Tell us a little about your team and the contracts you handle. We'll set up a short call and show you the parts that matter to you.