Security programme and SOC 2 roadmap
Law Hired is not SOC 2 certified. This page shows which controls exist today, which are in progress, and which are not started, so you can judge for yourself.
Security
Tenant isolation in the database
Evidence: Row-level security on every table; a test fails if a table lacks a policy.
Multi-factor sign-in and firm-wide MFA policy
Evidence: TOTP enrolment, step-up on trust payments, firm "require MFA" setting.
Single sign-on for firms
Evidence: SAML sign-in with a pilot runbook.
Independent penetration test
Next: Engage a third party; publish the summary.
Documented security policies approved by management
Next: Access, change, incident and vendor policies written and signed.
Availability
Health probes with automatic restart
Evidence: Public status page and container health checks.
Incident record
Evidence: Every outage listed with cause and change on the status page.
Tested backup restore
Next: Restore a backup end to end, time it, and publish the recovery time.
Separate development and production databases
Evidence: The development server uses its own database.
Next: Point every script and tool at it by default, separate file storage, and stop copying client records into development.
Redundant production hosting
Next: Move from a single free-tier host to paid, redundant hosting.
Confidentiality
Encryption in transit and at rest
Evidence: TLS everywhere; storage encryption provided by the database and object store.
Controls over what AI may read
Evidence: Per-matter and per-document switches, firm default, firm-only knowledge with confirmation.
Record of who and what read each matter
Evidence: Each time a person opens a matter or a document it is recorded (who, when, which record) on the firm Audit Logs page, with CSV and PDF export; repeat opens inside ten minutes are one entry.
Processing integrity
Verified-by and date on legal rules and figures
Evidence: Reference data and deadline rules carry the verifying attorney and date.
Next: Show it on every rule, figure and template; publish the coverage matrix.
Change control
Evidence: Every change passes lint and tests before commit; migrations are additive, idempotent and recorded.
Figures calculated and recorded
Evidence: Each calculation stores the inputs and the reference version it used.
Privacy
Data processing agreement
Evidence: Published at /dpa.
Subprocessor list
Evidence: Hosting, sign-in, payments and AI providers are named on the security page.
Next: Name every provider with what it receives and where it processes it.
Export and deletion on request
Next: Self-service full export of matters, documents and ledgers.
The path to an attestation
Close the gaps above
Policies, a tested restore, separate environments, redundant hosting, a penetration test.
Choose an auditor and a readiness assessment
A readiness review against the criteria before the formal audit.
SOC 2 Type I
The auditor confirms the controls are designed appropriately at a point in time.
Observation period
Controls are operated and evidenced continuously, normally three to twelve months.
SOC 2 Type II
The auditor confirms the controls operated effectively over the period; the report is shared under NDA.