The information security management system of ModulawAI Inc. is now certified to ISO/IEC 27001:2022, under UAF accreditation. Certificate AMER502726 was issued on November 6, 2026 and runs for three years, subject to annual surveillance audits.
You give us privileged advice, litigation strategy and client identities, and you answer for how that information is handled. Until today, your assurance about our security came from us. You now have a certification body’s assessment as well, and you can put it in front of your clients and your procurement team.
What the certificate covers
ISO/IEC 27001 sets out how an organization should run an information security management system: how it identifies risks to its information, chooses controls for those risks, and checks that the controls work. Our scope covers the ModulawAI platform, its software development, cloud infrastructure operations and customer support.
The certificate applies to the way we manage security. It does not certify our software as a product, and you should read any vendor’s claim with that distinction in mind, including ours.
The controls behind it
Our Trust Center lists 40 controls that operate today, and our ISMS records hold the evidence for each one. A few that law firms ask about most:
- AI training. Section 14 of our DPA prohibits using your content to train, fine-tune or improve any AI model, ours or a provider’s, without your separate written consent.
- AI retention. We set our main model providers to keep no prompts or outputs.
- Staff access. Staff do not open your uploaded documents except for support with your consent, and we log that access. Administrators need MFA, and we review access quarterly.
- Backups. We back up the main database every 6 hours, with point-in-time restore for the last 7 days.
Using it in a vendor review
If a client questionnaire or a procurement review asks about ModulawAI, quote certificate number AMER502726. If you need to verify it, email security@modulaw.ai.
Your security team may want more than the number. Through the Trust Center you can request our Statement of Applicability, ISMS scope, Incident Response Plan and security policies. We share those with customers, prospects and auditors after review, under our confidentiality terms.
What the certificate does not tell you
No certificate can promise that a breach will not happen. If one does, we follow a documented incident response plan and notify affected customers without undue delay, and no later than 48 hours after we become aware of it, as our DPA sets out.
ISO 27001 is also a different thing from SOC 2. Our controls align with the SOC 2 Trust Services Criteria on our own assessment, and we do not hold an audited SOC 2 report. If your review requires one, tell us early.
Some of the protection stays in your hands. You decide who in your firm can reach which matters, and you can require MFA for every member from your workspace security settings. If you have not turned that on, it takes one setting.
What happens next
The certificate schedules our first surveillance audit for November 2027 and recertification for November 2029. We update the Trust Center as our controls change. Send security questions to security@modulaw.ai.