Security & trust

Data stays in Malaysia. Always.

The LegalByte aOS runs entirely on AWS ap-southeast-5 — the Kuala Lumpur region. Every layer of the system — inference, embeddings, storage, audit logs — stays onshore. PDPA-compliant by design, not retrofit. Security & Governance is the seventh layer of the aOS, not an afterthought.

Read full security overview Request trust pack

AWS ap-southeast-5

Inference, storage, indexing — all in KL.

PDPA 2010 native

DPIA on file. Controller: LegalByte.my Sdn Bhd.

No training on your data

Conversations & uploads never used for training.

Encrypted

AES-256 at rest · TLS 1.3 in flight · per-firm KMS.

Our commitments

Six promises, each one auditable.

01 · Residency

Onshore by default

Every byte — uploads, embeddings, audit logs — lives in AWS Kuala Lumpur. Disaster recovery intra-region.

02 · No training

Your data is not the model

We don't train, fine-tune or evaluate on customer data. Anthropic processes ephemerally under Zero-Day-Retention.

03 · Citations

Anti-hallucination

Every citation in product output is verified against AGC corpus before render. If it doesn't verify, it isn't shown.

04 · Access

Tenant isolation

S3 paths scoped per firm. Vector queries enforce firm_id on every read. Audited.

05 · Identity

SSO & SCIM on Enterprise

Okta · Microsoft Entra · Google Workspace · custom SAML 2.0. SCIM 2.0 provisioning.

06 · Audit

Cryptographic audit chain

Every chat, upload, approval and export is hashed into a tamper-evident chain. 3,651+ events verified. Stored 7 years. CSV export on request.

Loading workspace…