Security

Your projects stay yours.

Legal work demands confidentiality by default. LegalByte is built so your data is stored in Malaysia, stays isolated to your firm, and never trains an AI model.

Malaysian data storage

Your documents and data are stored in AWS Kuala Lumpur (ap-southeast-5). AI inference runs on AWS Bedrock's global secure infrastructure under AWS's data-processing terms; your data is never retained or used to train any model.

Zero AI training on your data

Your projects are never used to train, fine-tune, or improve any AI model — ours or a provider's. Your corpus works for you alone.

Encrypted in transit and at rest

TLS in transit and SSE-KMS encryption at rest, with bring-your-own-key (BYOK) available for firms that require it.

Full tenant isolation

Each firm is isolated. No firm — and no other firm's user — can see your data. Access is scoped to your firm at every layer.

Tamper-evident audit trail

Every action the system takes is written to a hash-chained audit log, so the record of what happened cannot be altered after the fact.

Source-pinned traceability

Every AI citation is traceable to the exact source it came from, so output can be checked against authority, not taken on trust.

Compliance posture

Engineered to the standards that matter for legal work.

LegalByte operates under Malaysia’s Personal Data Protection Act 2010 (PDPA). Our controls are engineered to align with the requirements of SOC 2, ISO/IEC 27001, and ISO/IEC 42001 (AI management systems). Formal certification against these standards is on our roadmap; we will publish each certification when it is awarded rather than before.

We describe what we have built, not badges we have not yet earned.

Governance & control

Consent before access
We access your data only to provide the service to you, scoped to your firm — never to train models or for any unrelated purpose.
Enterprise identity
Single sign-on via SAML 2.0 is available for firms, so access follows your existing identity provider and offboarding.
Export and deletion
Your firm can export its data, and we delete it on the terms of your agreement when the relationship ends.
Approval-gated actions
Actions that reach outside the platform — sending an email, writing to a connected drive — require explicit human approval before they run.

Questions from your security team?

We're glad to walk through our controls in detail.

Request a demo

Engineered to the standards that matter for legal work.

We describe what we have built, not badges we have not yet earned.