Trust
ModulawAI Trust Center
Law firms trust us with privileged material. This page shows how we protect it: the controls in place today, how AI providers handle your data, and the documents your security team can request.
Last reviewed: October 15, 2026
Overview
Get in touch
Security: security@modulaw.ai
Privacy and legal: dpo@modulaw.ai
Questions are reviewed by our Chief Legal Officer and our security lead.
Policies and documentation
Report a vulnerability or AI concern
If you find a security issue, or an AI output that could cause harm, email security@modulaw.ai. We acknowledge reports within two business days, offer safe harbour for good-faith research, and thank researchers publicly. See our Vulnerability Disclosure Program.
Compliance
- ISOISO/IEC 27001:2022
Aligned, certification in progressOur information security management system follows ISO 27001. Independent internal audit is scheduled before the certification audit. We are not certified yet. - GDPREU GDPR
Processor terms in placeOur DPA includes the EU Standard Contractual Clauses (2021/914), Modules 2 and 3. - UKUK GDPR
Processor terms in placeOur DPA includes the UK International Data Transfer Addendum. - NDPANigeria Data Protection Act 2023
AlignedBreach procedure and records of processing maintained under the NDPA.
Controls (40)
Only controls operating today are listed. Each one is backed by evidence in our ISMS records.
No controls match that search.
Infrastructure security 8 controls
- Encryption in transitTLS on every public endpoint, with HSTS.
- Encrypted, private, versioned document storagePublic access blocked, AES-256 at rest, previous versions kept.
- Database closed to the internetOnly named server addresses can connect. Checked daily.
View 5 more infrastructure security controls
- No direct server loginNo SSH. Administrative access goes through AWS Systems Manager only.
- Inbound traffic limited to web portsThe cache is reachable only from the application server.
- Tamper-evident cloud audit trailAWS CloudTrail across all regions, with log file validation.
- Log retention on every log groupLogs are kept for a set period, then deleted.
- Monitored alertingInfrastructure and security alarms go to an on-call channel.
Organizational security 5 controls
- Quarterly access reviewsCloud, code, database and admin access reviewed, findings fixed and recorded.
- MFA for ModulawAI administratorsRequired for every platform administrator account.
- Risk register and Statement of ApplicabilityRisks rated, owned and reviewed against ISO 27001 Annex A.
View 2 more organizational security controls
- Production credentials changed only with fresh MFAEach change needs a new authenticator code, is written by a separate restricted service, is logged, and alerts every administrator. Values are never shown back.
- Credential rotation trackedEvery third-party credential has a rotation date, and administrators are alerted daily when one falls due.
Product security 7 controls
- Role-based permissions in each firmAccess enforced across workspace, matter, client and portal boundaries.
- Multi-factor authentication for every userAuthenticator-app MFA available on all accounts.
- Expiring links for every fileFiles are never served from a permanent public URL.
View 4 more product security controls
- Firms can require MFA for everyoneA workspace setting makes MFA mandatory for every member at sign-in.
- Hardened sessionshttpOnly cookies, CSRF tokens and refresh-token rotation.
- Login rate limitingRepeated sign-in attempts are throttled and raise a security alert.
- Audit log of user and admin actionsSign-in, matter, client, document, billing and workspace events, with who did what.
Internal security procedures 7 controls
- Security code scanning on every changeStatic analysis blocks a merge when it finds a security issue.
- Secret scanning on every changeCredentials cannot be merged into our code.
- Daily automated compliance checksCloud configuration is checked every day and failures raise an alert.
View 4 more internal security procedures controls
- Dependency vulnerability alertsKnown vulnerabilities in our dependencies are flagged automatically. Checked daily.
- Development never uses customer dataSeparate environment with synthetic data only.
- Written secure coding standardCovers input handling, injection, secrets and dependencies.
- Exposed credentials revoked at the sourceAny exposed key is revoked with its provider and logged.
Data and privacy 5 controls
- Your content never trains AIA contractual commitment in our DPA, section 14.
- Personal data masked in logsEmails and phone numbers are masked; prompts and transcripts are not logged.
- DPA with EU and UK transfer clausesStandard Contractual Clauses and the UK Addendum built in.
View 2 more data and privacy controls
- Cloud AI services opted outAWS may not store or use our content to improve its AI services.
- Export and erasure requestsA documented process for data subject requests.
AI governance 5 controls
- Zero data retention on AWS BedrockRetention set to none and invocation logging off. Checked daily.
- Zero data retention for open-weight modelsFireworks AI keeps no prompts or outputs for the models we use.
- Vendor terms checked before a model goes liveTraining, retention and region recorded for every model.
View 2 more AI governance controls
- Search embeddings with zero retentionText is turned into search vectors only through a zero-data-retention route.
- AI monitoring without contentRun monitoring keeps metadata only, for 14 days.
Business continuity 3 controls
- Database backups every 6 hoursPoint-in-time restore for the last 7 days.
- Backups kept up to one yearDaily, weekly, monthly and yearly snapshots.
- Document restore testedRestoring a prior file version tested and recorded.
Resources
Public
Policies
Procedures
Plans and assessments
Restricted documents are shared with customers, prospects and auditors after review, under our confidentiality terms. Request access.
Frequently asked questions
Do you use our data to train AI models?
No. Our DPA (section 14) prohibits using your content to train, fine-tune or improve any AI model, ours or a provider’s, without your separate written consent. Our main model providers are set to keep no prompts or outputs.
Where is our data stored and processed?
In the United States: Amazon Web Services (us-east-2) and MongoDB Atlas (AWS us-east-1). Our team administers the service from Nigeria. Live call audio and video are relayed through our own server in South Africa. We do not host data in the EU or UK today.
How is our data encrypted?
In transit with TLS and HSTS. At rest with AES-256 on Amazon S3 and MongoDB Atlas. Stored sign-in tokens for connected accounts and MFA secrets are also encrypted at application level with AES-256-GCM.
Who at ModulawAI can access our data?
Only staff who operate and support the service, and only when needed. Administrator accounts require MFA, production access goes through AWS Systems Manager with no direct server login, and access is reviewed every quarter. Staff do not open your uploaded documents except for support with your consent, and such access is logged.
Are you ISO 27001 certified?
Not yet. We run an information security management system aligned to ISO/IEC 27001:2022, with an independent internal audit scheduled before the certification audit. We will update this page when we are certified.
Do you support MFA and single sign-on?
Every user can turn on authenticator-app MFA, a firm can require it for all its members from workspace security settings, and it is required for ModulawAI administrators. Sign-in with Google is available. SAML single sign-on for enterprise firms is on our roadmap.
How would you handle a data breach?
We follow a documented incident response plan and notify affected customers without undue delay, and no later than 48 hours after we become aware of a breach, as set out in our DPA.
How are backups handled?
The main database is backed up every 6 hours with point-in-time restore for the last 7 days, and snapshots are kept for up to one year. Documents are versioned, so earlier versions can be restored.
Which AI providers process our content?
See “AI and your data” below and our subprocessors list, which shows each provider, its purpose and where it processes data.
Subprocessors (29)
The third parties that process data for us, and where. We give enterprise customers 30 days’ notice before adding one. Purposes, transfer safeguards and the change log are on the full subprocessors list.
Hosting and infrastructure
AI and inference
Voice and telephony
Messaging and payments
Legal research
Website analytics, with consent only
AI and your data
What we commit to. Your content is never used to train AI models. Each provider receives only what it needs to answer a request. We record every model’s training, retention and region terms before it goes live, and remove models that do not meet them.
What we check. Our AWS Bedrock settings (zero retention, invocation logging off) are checked automatically every day.
Full list of providers, purposes and locations: Subprocessors.
| Provider | Used for | Your content kept? |
|---|---|---|
| AWS Bedrock | AI models (Claude, Nova, open-weight) | No, zero retention |
| Fireworks AI | Open-weight models | No, zero retention |
| Amazon Textract | Reading scanned documents | Not used to improve the service |
| Deepgram | Speech to text | Model improvement opted out |
| LangSmith | AI run monitoring | No, metadata only |
| ElevenLabs | Text to speech | Not used for training (opted out); otherwise standard terms |
| OpenRouter to Microsoft Azure | Search embeddings | No, zero retention |
| Cartesia, TinyFish, Tavily | Voice fallback, citation checks, web search | Standard provider terms; only what each function needs |
Request documents
Use your work email. We confirm your address, review the request, and email you a private link. You accept our confidentiality terms the first time you open the documents.
Updates
- October 15, 2026Published this Trust Center and our Vulnerability Disclosure Program. Production credentials can now be changed only with a fresh MFA code, and their rotation dates are tracked. Retired Microsoft Azure: all files are in Amazon S3, and search embeddings now go only through a zero-data-retention route. Our daily automated checks now also cover database network access and dependency vulnerability alerts.
- October 14, 2026Turned on the AWS organisation-wide opt-out for AI services. Security code scanning and secret scanning now block every change.
- October 13, 2026Updated our Data Processing Agreement with the EU Standard Contractual Clauses and the UK Addendum, and corrected our subprocessors list.