Legal work runs on privilege and confidentiality. KANOLOGY is built so that your contracts, opinions and pleadings are protected at every stage - from upload to storage to output - using industry-leading security standards. This page describes the technical and organizational measures we apply.
End-to-end encryption
All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Encryption keys are managed through a dedicated key-management service with strict rotation and access policies, in line with GDPR Articles 25 and 32, the DIFC Data Protection Law and ISO/IEC 27018.
Strict data isolation
Each customer's information is held in a logically isolated environment. Tenant boundaries are enforced at the storage, application and model layers so that documents from one firm or department are never visible to, or used to serve, another. Your Vault precedent stays yours.
User-controlled access
You decide who can see what. Granular, role-based permissions, single sign-on support and detailed audit logs give administrators full control over access to workspaces, matters, modules and outputs.
No training on your documents
Documents and prompts you submit are used solely to deliver the Services to you. They are not used to train or fine-tune models made available to other customers.
Certifications and compliance
- SOC 2 Type I and Type II - independently audited controls for security, availability and confidentiality.
- ISO 27001 - certified information security management across our infrastructure.
- ISO/IEC 27018 - protection of personal data in public cloud environments.
- GDPR & DIFC Data Protection Law - privacy-by-design and privacy-by-default across our Services.
Data residency and sub-processors
Customer data is hosted on enterprise cloud infrastructure (AWS, Microsoft Azure and Google Cloud) in regions agreed with each customer, including in-region hosting options for GCC clients. A current list of sub-processors and hosting regions is available on request.
Incident response
We maintain a documented incident-response process with continuous monitoring, defined escalation paths and customer notification within the timeframes required by applicable law, including the 72-hour GDPR breach notification window.
Data subject requests and deletion
We support customers in fulfilling data subject requests and delete or return customer data at the end of the contractual relationship, subject to legally required retention. See our Privacy Policy for details on personal data handling.
Security enquiries
To request our security documentation, a Data Processing Agreement or to report a vulnerability, contact contact@kanology.com.