Trust, Security & Compliance

Trust at Legalyard AI

Legalyard AI handles legal and finance-adjacent information for individuals, students, and professionals worldwide. The data you share with us deserves enterprise-grade care — even on a consumer Service. This page is the single source of truth for our compliance posture, security controls, subprocessor list, AI governance, and answers to procurement questions.

We publish this page openly because verifiable trust beats marketing claims. Where a control or certification is not yet in place, we label it honestly (in progress, planned, inherited). We do not inflate posture.

Procurement & legal pack

Need our DPA, SCCs, a security questionnaire, the sub-processor list, or a redlines round? Email legal@email.legalyard.com.

Compliance Programmes

Status reflects our current posture, not aspirational marketing. We will not claim a certification until it is in hand.

EU GDPR / UK GDPR
Aligned
Privacy for EU/EEA/UK users
Transfers on adequacy where in force, otherwise SCCs (June 2021); no Privacy Shield or DPF reliance. Rights honoured via the in-app export and erasure flows. No EU or UK representative designated yet.
India DPDPA 2023
Aligned
Privacy for Indian users
Grievance officer designated. Residency declaration, verified erasure flow, and consent records in place. Notices in plain language.
CCPA / CPRA (California)
Aligned
Privacy for California residents
No sale, no share for cross-context behavioural advertising. GPC honoured. SPI use limited to service delivery. Authorised-agent flow supported.
LGPD (Brazil)
Aligned
Privacy for Brazilian users
DPO (Encarregado) designated. ANPD-aligned rights flow.
PIPEDA + Quebec Law 25 (Canada)
Aligned
Privacy for Canadian users
Quebec automated-decision-making disclosure included.
APPI (Japan)
Aligned
Privacy for Japanese users
Cross-border transfer disclosures and rights flows in place.
PDPA (Singapore)
Aligned
Privacy for Singapore users
Notice + consent + withdrawal flows supported.
SOC 2 Type II
In progress
Service organisation controls (Security, Availability, Confidentiality, Privacy)
Preparation is under way: control evidence is captured in the platform against the trust criteria. No assessor has been engaged and no report exists yet, so none can be produced on request. We have not committed to a date.
ISO/IEC 27001
Planned
Information security management system
Not started. Listed because reviewers ask; we would rather say no than imply a timeline we have not committed to.
ISO/IEC 27701
Planned
Privacy information management system
Not started. The privacy extension to 27001 follows it; neither has a committed date.
ISO/IEC 42001
Planned
AI management systems
Not started. On the list because the product is AI-native; no assessor has been engaged and no date is committed.
PCI-DSS
Inherited
Payment card data
We never receive raw card data. Payments are processed by PCI-DSS Level 1 certified providers (Razorpay, Paddle, Apple, Google).
HIPAA
Planned
US health information (B2B)
We do not sign Business Associate Agreements today — no BAA exists to send, on any tier. Do not upload protected health information to Legalyard AI.
EU AI Act
Aligned
AI governance for EU/EEA
Transparency, human-oversight, and risk-management practices aligned. Classification assessment ongoing as implementation milestones land.
India IT Act 2000 & SPDI Rules
Aligned
Privacy & cybersecurity in India
Reasonable security practices documented; grievance officer designated; incident-response runbook in place.
CERT-In Directions 2022
In progress
Cyber-incident reporting in India
6-hour incident-reporting playbook written. CERT-In's own FAQ (Q37) frames the 180-day rolling log-retention direction around logs that support cyber-incident analysis — firewall, access, and application-event logs recording both successful and unsuccessful events — not general product-usage or AI-request analytics. Read that way, sign-in and security activity is retained for 365 days, clearing the 180-day floor; usage and AI-request telemetry is a separate, lower-sensitivity category the Privacy Policy bounds on its own 90-day window and is not the log class this direction targets. What remains open: we have no distinct infrastructure-level access/request log (webserver, reverse-proxy, load balancer) as an application concern, so if CERT-In's scope reaches that log class too, we cannot currently evidence compliance on it from application code alone.

Security Controls

Encryption

Transit: TLS for every connection to the Service, web and mobile
Stored files: server-side encryption in object storage (AES-256; cloud key management where configured)
Application-level encryption (AES-256-GCM), with keys we manage, of message text, conversation titles, extracted document text, push-notification keys, and integration access tokens — the default key store is local to our infrastructure; a cloud KMS key-wrapping path is provisioned but not yet the active default for any tenant
Secrets: deployment secrets are held outside source control

Authentication & access

Passwordless sign-in: one-time email codes, or federated sign-in via Google, Apple, LinkedIn, Microsoft
Session tokens are opaque and stored only as hashes; one-time codes and the email they were sent to are stored only as salted hashes
Sign-in and waitlist forms are bot-protected (Cloudflare Turnstile on web, hCaptcha in the mobile app) and rate-limited
You can list and revoke your own signed-in sessions from Settings → Account
Support staff can open only a read-only, per-case, 30-minute view of a consumer account; it cannot send messages or spend credits, and every such session is recorded
Not offered today: multi-factor authentication for consumer accounts

Network & infrastructure

The Service is served behind Cloudflare, and nothing behind it is reachable from the internet directly
All API requests are authenticated except the explicitly public routes (sign-in, waitlist, public share pages, legal documents, status)
Hosting region is fixed by deployment and listed per processor in the sub-processor register

Application security

Mandatory code review and required CI checks (lint, type-check, unit and end-to-end tests) before merge
Dependency and supply-chain checks in the build pipeline: lockfile pinning, install-script scanning, and vulnerability audit
Input validation on every request; uploads verified by file signature, extension, and declared type
SVG sanitisation and content-type protections on served files
Structured identifiers replaced with placeholders before prompts reach AI providers

Logging, monitoring & response

Product-usage analytics and AI request logs are first-party and kept 90 days; sign-in activity is kept 12 months
Application errors are captured in structured logs on our own infrastructure (Content scrubbed); we do not send them to a third-party error tracker, and will name one here if that changes
Rate limits and abuse-velocity controls on chat and sign-in; automated screening of prompts and Outputs with staff review of flagged items
Written incident-response runbook; customer notification for material incidents as described in the Privacy Policy

People security

Confidentiality and acceptable-use obligations in every employment and contractor agreement
Production access on a least-privilege basis; consumer-account support access is read-only and audited (see above)

Privacy Controls

Data minimisation. We collect only the personal data we need, and the Privacy Policy lists every category by name. Sensitive Content is never written in plain text into our logs.
Purpose limitation. Data collected for one purpose is not repurposed without a fresh review and (where required) consent.
Consent management. Cookie-consent banner honouring Global Privacy Control; the corrections-capture switch and the residency declaration in Settings → Privacy; consent records kept as evidence.
Your data, self-serve. Export (JSON or ZIP), erasure, and account deletion from Settings → Privacy; sessions and push notifications from Settings → Account; memories from Settings → Personalisation. Email privacy@email.legalyard.com for assisted requests.
No model training. Your content is not used to train or fine-tune AI models, on any plan. Corrections you allow us to capture are kept 90 days and used only to improve answer quality.
Cross-border transfers. Adequacy decisions where in force; otherwise Standard Contractual Clauses (with the UK Addendum for UK transfers). No reliance on Privacy Shield or the Data Privacy Framework. Each processor's transfer basis is shown in the sub-processor register.

AI Governance & Responsible AI

We use foundation models from named, accountable providers — not anonymous or low-trust hosts. Every provider that sees your prompts or your Content is listed below, generated from the same sub-processor register the table in section 6 renders, together with the retention posture we have actually recorded for it. This page carries no hand-written provider list, so it cannot disagree with the register. Around those models we add grounded retrieval, jurisdiction-aware answering, prompt-construction safety, and output checks.

No training on your Content. Legalyard does not train or fine-tune models on your prompts, uploads, conversations, or Outputs, on any plan. What each provider is recorded as permitted to do with what it receives is printed below from the register.
Identifiers masked before your prompt leaves Legalyard. Email addresses, phone numbers, card numbers, bank account and IBAN numbers, Aadhaar, PAN, GSTIN, and Social Security numbers are replaced with placeholders before a prompt reaches a provider and restored only in your view. Names, case facts, addresses, and organisation names are NOT masked, because legal reasoning depends on them — they reach the provider as written. Pixels in an attached image are not text a masking pass can act on, so an identifier visible only inside an uploaded image or photo also reaches the provider unmasked.
Jurisdiction. Each answer is written under a jurisdiction chosen in a fixed order — what the question names, what the thread established, then your profile country or device time zone — never your browser language. The jurisdiction used is shown with the answer and can be corrected.
Transparency. Outputs are labelled as AI-generated. Citations are attributed and link to the source for user verification.
Safety screening. Prompts and Outputs are screened for child sexual abuse material, hate speech, violence, attempts to extract or override the assistant's instructions, and off-topic misuse. Some matches are refused; others are flagged for review by authorised staff.
Human oversight. No fully-autonomous decisions about you. Consequential actions on a user (suspension, deletion) involve meaningful human review. There is no separate human approval gate before you see an AI answer: you are the reviewer of every Output. Sources are inspectable (open the citation), editable (you can correct or override what the assistant drafted), and flaggable (report an answer for staff review). We do not market Outputs as "human-reviewed" — no professional reviews an answer on your behalf before it reaches you.
Evaluation. We maintain evaluation suites for jurisdictional accuracy, citation faithfulness, and prompt-injection resistance, and run them before material model changes ship.
Bar / professional conduct awareness. We surface clear AI disclaimers and (in legal contexts) reminders to verify Outputs against primary sources.
EU AI Act readiness. We track classification of our features against the EU AI Act risk levels and apply the additional transparency, oversight, and risk-management obligations to any feature classified as high-risk.

Models we use

Each request is matched to a model tier by the kind of work it asks for. This table is read live, so it changes when our model choices change.

Tier	Provider	Model family	Used for
Fast	GEMINI	Gemini Flash Lite	High-volume classification, intent recognition, summarisation and embedding work, where a small model is as correct as a large one (24 of 45 routed task types).
Standard	GEMINI	Gemini Flash	Document analysis, structured extraction and review passes, where output reliability matters more than raw eloquence (15 of 45 routed task types).
Deep	ANTHROPIC	Claude Sonnet	Legal drafting, research agents and premium app runs, where output quality is business-critical (6 of 45 routed task types).

Model choices last changed 12 Sept 2026.

Providers that process your Content

Of the 8 AI providers in the register, 0 are recorded as excluded from provider-side training, 0 as zero-data-retention, and 0 have a recorded vendor-contract review. Where a review is not recorded, the provider runs on its standard published terms and we do not claim otherwise.

Inference

Anthropic, PBC
United States
AI model provider — Claude models, used for drafting and for checking a draft before you see it
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
Standard Anthropic commercial API terms. Anthropic has no per-request setting to opt a request out of its standard retention window; zero data retention is instead a separate enterprise arrangement that an organisation applies for and Anthropic approves, which Legalyard has not done. Checked the completion and streaming request builder for a request-level retention/no-train parameter equivalent to OpenAI's `store:false`: the Anthropic Messages API exposes none. No retention or training option is set on the request and no vendor term has been read to confirm a stronger posture.
Contract reviewed
No vendor contract review recorded
Google LLC
United States · European Union · India
AI model provider — Gemini models, used for high-volume text work, for reading page and figure images, and for indexing the documents you upload so they can be searched
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
Google Cloud / AI Studio terms for whichever backend this deployment is configured against — the two differ on retention, and no vendor term has been read to confirm a stronger posture for either. Content-safety thresholds are set on the request; those bound refusals, not retention. Google's governance lever here is which of its two Gemini backends a request reaches, not a retention field on the request itself. The Vertex AI backend is selected over the AI Studio consumer API automatically whenever its configuration is complete (a GCP project plus a service-account credential, or a Vertex express-mode key), for chat/completion, OCR and vision embeddings alike, and carries Google Cloud's enterprise data-governance terms (no training on prompts, configurable data residency, CMEK, VPC-SC); AI Studio remains the fallback when no Vertex credential is configured for this deployment, or on an explicit retry after a failed Vertex call. This deployment has not confirmed which backend is actually live in any given environment, nor signed the Cloud data-processing terms that Vertex use implies — that confirmation is an owner action, not a code gap.
Contract reviewed
No vendor contract review recorded
Receives raw Content
indexing, OCR, vision
OpenAI, LLC
United States · European Union
AI model provider — GPT models, used to work out what a request is asking for; indexing of the documents you upload so they can be searched; and transcription of audio you ask to have written out
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
OpenAI commercial API terms. Provider-side storage of completions is switched off on the request; no training or zero-retention term has been read to confirm a stronger posture.
Controls we set
Provider-side storage of the request and the answer is switched off on every call we make.
Contract reviewed
No vendor contract review recorded
Receives raw Content
audio, indexing

Retrieval & research

Cohere, Inc.
Canada · United States
Relevance ranking — puts the passages found for your question into the order most likely to answer it
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
Cohere commercial API terms. No retention or training option is set on the request and no vendor term has been read to confirm a stronger posture.
Contract reviewed
No vendor contract review recorded
Exa Labs, Inc.
United States
Web search — searches the public web for a research question; used only where this provider is enabled
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
Exa commercial API terms. No retention or training option is set on the request and no vendor term has been read to confirm a stronger posture.
Contract reviewed
No vendor contract review recorded
Perplexity AI, Inc.
United States
Web search — answers a research question by searching the public web
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
Perplexity commercial API terms. No retention or training option is set on the request and no vendor term has been read to confirm a stronger posture.
Contract reviewed
No vendor contract review recorded
SuSea, Inc. (You.com)
United States
Web search — searches the public web for a research question; used only where this provider is enabled
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
You.com platform API terms. No retention or training option is set on the request and no vendor term has been read to confirm a stronger posture.
Contract reviewed
No vendor contract review recorded
Tavily Research, Inc.
United States
Web search — searches the public web for a research question; used only where this provider is enabled
Training
Provider's standard terms — no training restriction recorded
Retention
No zero-retention term recorded
Basis
Tavily commercial API terms. No retention or training option is set on the request and no vendor term has been read to confirm a stronger posture.
Contract reviewed
No vendor contract review recorded

Most requests send a prompt and the excerpts needed to answer it. These lanes send raw Content instead: audio, indexing, OCR, vision.

Subprocessors

Every third party that receives your data to deliver the Service, grouped by what it does. Only AI providers and legal databases see your prompts, documents or search terms; the rest receive the specific items listed. We notify customers in advance of material changes. This list is part of our Data Processing Agreement.

Subprocessor	Purpose	Country	Data accessed	Content retention	Transfer mechanism
AI model and search providers9
Anthropic, PBC	AI model provider — Claude models, used for drafting and for checking a draft before you see it	United States	Your prompts and the excerpts of your documents needed to answer them, with personal identifiers replaced by placeholders before sending	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
OpenAI, LLC	AI model provider — GPT models, used to work out what a request is asking for; indexing of the documents you upload so they can be searched; and transcription of audio you ask to have written out	United States · European Union	Your prompts and document excerpts (identifiers replaced by placeholders); the full text of documents you index, for embeddings; and audio files you ask to have transcribed	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Google LLC	AI model provider — Gemini models, used for high-volume text work, for reading page and figure images, and for indexing the documents you upload so they can be searched	United States · European Union · India	Your prompts and document excerpts (identifiers replaced by placeholders); the full text of documents you index, for embeddings; the original bytes of documents sent for AI text extraction; page and figure images	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Google LLC (Cloud Document AI)	OCR — text + layout extraction from uploaded documents whose text layer is missing or unreliable	United States · European Union · India	The original bytes of documents you upload whose text cannot be read directly, for text and layout extraction	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Cohere, Inc.	Relevance ranking — puts the passages found for your question into the order most likely to answer it	Canada · United States	Your question and the candidate passages retrieved for it, with personal identifiers replaced by placeholders, so they can be re-ordered by relevance	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Perplexity AI, Inc.	Web search — answers a research question by searching the public web	United States	Your research question as a web-search query, with personal identifiers removed before sending	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Tavily Research, Inc.	Web search — searches the public web for a research question; used only where this provider is enabled	United States	Your research question as a web-search query, with personal identifiers removed before sending	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Exa Labs, Inc.	Web search — searches the public web for a research question; used only where this provider is enabled	United States	Your research question as a web-search query, with personal identifiers removed before sending	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
SuSea, Inc. (You.com)	Web search — searches the public web for a research question; used only where this provider is enabled	United States	Your research question as a web-search query, with personal identifiers removed before sending	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Public legal databases21
Free Law Project (CourtListener)	US case-law data source — read-only lookups against a public court-record publisher; it receives the words of the search and none of your documents or account records	United States	A case citation, judge name or matter type as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
IndianKanoon (Quartz Communications Pvt. Ltd.)	India case-law and statute data source — read-only lookups against a public publisher; it receives the words of the search and none of your documents or account records	India	A case citation, statute reference or judge name as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	DPDPA 2023 consent + cross-border transfer notice
British and Irish Legal Information Institute (BAILII)	UK case-law data source — read-only lookups against a public publisher; it receives the words of the search and none of your documents or account records	United Kingdom	A case citation or case name as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Cornell Legal Information Institute	US statute-lookup data source — read-only public lookup. NO firm-side PII flows	United States	A statute or regulation reference; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
EUR-Lex (Publications Office of the European Union)	EU legislation + case-law data source — read-only public lookup. NO firm-side PII flows	European Union (Luxembourg) · European Union	An EU legislation or case reference; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Canadian Legal Information Institute (CanLII), operated by the Federation of Law Societies of Canada	Canada case-law data source — citation verification through the licensed CanLII API; engaged only on deployments holding a CanLII API key	Canada	A case citation or CanLII case identifier being verified; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Australasian Legal Information Institute (AustLII), UNSW Sydney and UTS	Australia case-law data source — read-only public search for citation verification	Australia	A case name or citation as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Library of Congress (congress.gov API)	US federal legislation data source — bill and public-law verification through the Library of Congress API; engaged only on deployments holding an API key	United States	A bill or public-law number being verified; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Administrative Office of the United States Courts (PACER)	US federal docket data source — hearing lookups by case number; engaged only on deployments holding a PACER credential	United States	A federal case number and court identifier; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
The National Archives (legislation.gov.uk)	UK legislation data source — statute section lookups from the official publisher; no credential required	United Kingdom	A statute and section reference; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
eCourts India (ecourtsindia.com) — commercial partner API for the India eCourts register	India court-record data source — case status by CNR number; engaged only on deployments holding a partner API key	India	A CNR case number; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	DPDPA 2023 consent + cross-border transfer notice
United States Government Publishing Office (govinfo.gov)	US Code data source — section lookups against the official publisher; no credential required	United States	A US Code title and section number; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
India Code (Ministry of Law and Justice, Government of India)	India statute data source — act and section lookups against the official repository; no credential required	India	An act name, section number or statute search term; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Justia Inc.	US state statute data source — read-only lookups against the published state codes	United States	A state, code and section reference as lookup terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Supreme Court of India	India case-law data source — read-only lookups against the Supreme Court of India judgment portal; it receives the words of the search and none of your documents or account records	India	A case citation or case name as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Gazette of India (Government of India)	India regulations data source — read-only lookups against the official Gazette of India, plus automated polling of its published-notice feed; it receives the words of a search and none of your documents or account records	India	A notification or regulation reference as search terms, and the titles of newly-published Gazette entries picked up by automated polling; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Reserve Bank of India	India financial-regulation data source — read-only lookups against the Reserve Bank of India’s published circulars and notifications; it receives the words of the search and none of your documents or account records	India	A circular, notification or regulation reference as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Securities and Exchange Board of India	India securities-regulation data source — read-only lookups against SEBI’s published regulations and circulars; it receives the words of the search and none of your documents or account records	India	A circular, regulation or notification reference as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
GST Council / Central Board of Indirect Taxes and Customs (CBIC)	India tax-regulation data source — read-only lookups against the GST Council’s and CBIC’s published notifications and circulars; it receives the words of the search and none of your documents or account records	India	A notification, circular or GST reference as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Courts and Tribunals Judiciary (judiciary.uk)	UK daily court-sitting data source — read-only lookups against the official published cause lists, used to check when a case is listed; it receives the court and date being checked and none of your documents or account records	United Kingdom	A court name and date, or a case name being checked against a day’s listing; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Court of Justice of the European Union (CURIA)	EU case-law data source — read-only lookups against the Court of Justice of the European Union’s own case-search portal; it receives the words of the search and none of your documents or account records	European Union (Luxembourg) · European Union	A case citation or case name as search terms; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Accounts and systems you connect12
Google LLC (Google Drive)	Cloud storage — reading files from a Google Drive account the user connects; engaged only where the integration is configured	United States · European Union · Global	The access you granted when you connected your account, the identifiers of the files and folders being opened, and the words you or the assistant search for. Your files and folders travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Microsoft Corporation (Microsoft 365 — OneDrive and SharePoint)	Cloud storage and document management — reading files from a OneDrive or SharePoint account the user connects, through Microsoft Graph; engaged only where the integration is configured	United States · European Union · Global	The access you granted when you connected your account, the identifiers of the files, folders and document libraries being opened, and the words you or the assistant search for. Your files, folders and document libraries travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Dropbox, Inc. (Dropbox International Unlimited Company for users outside North America)	Cloud storage — reading files from a Dropbox account the user connects; engaged only where the integration is configured	United States · European Union	The access you granted when you connected your account, the identifiers of the files and folders being opened, and the words you or the assistant search for. Your files and folders travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Box, Inc.	Cloud storage — reading files from a Box account the user connects; engaged only where the integration is configured	United States · European Union	The access you granted when you connected your account, the identifiers of the files and folders being opened, and the words you or the assistant search for. Your files and folders travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
MEGA Limited	Cloud storage — reading files from a MEGA account the user connects with their MEGA email and password	New Zealand · European Union	The MEGA email address and password you enter, which are sent to MEGA to open the session, plus the identifiers of the files being opened and the words you or the assistant search for. Your files travel from MEGA into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
iManage LLC	Document management — reading documents from an iManage Work library the user connects; engaged only where the integration is configured	United States · European Union · Australia	The access you granted when you connected your account, the identifiers of the documents and workspaces being opened, and the words you or the assistant search for. Your documents and workspaces travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
NetDocuments Software, Inc.	Document management — reading documents from a NetDocuments cabinet the user connects; engaged only where the integration is configured	United States · European Union · Australia	The access you granted when you connected your account, the identifiers of the documents and cabinets being opened, and the words you or the assistant search for. Your documents and cabinets travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Google LLC (Gmail)	Connected mailbox — searching a Gmail account the user connects, through Google’s connector endpoint; engaged only where the integration is configured	United States · European Union · Global	The access you granted when you connected your account, the identifiers of the mailbox messages being opened, and the words you or the assistant search for. Your mailbox messages travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
DocuSign, Inc.	Connected e-signature account — reading envelope status from a DocuSign account the user connects; engaged only where the integration is configured	United States · European Union	The access you granted when you connected your account, the identifiers of the signature envelopes being opened, and the words you or the assistant search for. Your signature envelopes travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
HubSpot, Inc.	Connected CRM — reading records from a HubSpot account the user connects; engaged only where the integration is configured	United States · European Union	The access you granted when you connected your account, the identifiers of the CRM records being opened, and the words you or the assistant search for. Your CRM records travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Stripe, Inc.	Connected payments account — reading invoices, payments and balance records from a Stripe account the user connects; engaged only where the integration is configured	United States · European Union	The access you granted when you connected your account, the identifiers of the payment and invoicing records being opened, and the words you or the assistant search for. Your payment and invoicing records travel from there into Legalyard, not the other way.	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Intuit Inc. (QuickBooks Online)	Accounting sync — pushing invoices, payments and credit notes into a QuickBooks Online company the firm connects; engaged only where the integration is configured	United States	The invoices, payments and credit notes your firm chooses to sync: the client name they are addressed to, the line-item descriptions, and the amounts and dates	Not applicable — No prompts, documents or search queries reach this party; it receives the accounting records your firm chooses to send into its own QuickBooks company. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Electronic signature2
DocuSeal (docuseal.com)	Electronic signature — running the signing ceremony for documents a firm sends for signature; enabled per organisation from the platform console	United States	The document being signed, in full, together with each signer’s name and email address, and the completed signature certificate and audit trail sent back	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Adobe Inc. (Adobe Acrobat Sign)	Electronic signature — alternative signing provider, engaged only on deployments configured for it	United States · European Union	The document being signed, in full, together with each signer’s name and email address, and the signed result returned	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
Hosting and infrastructure7
Amazon Web Services, Inc.	Hosting — stores the documents you upload and runs the Legalyard applications	United States · European Union · India	Everything the platform stores and runs: your documents and account data at rest	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
MongoDB, Inc.	Database — holds your account, conversation, document and billing records	United States · European Union · India	Your account, conversation, document and billing records — the primary database	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Redis Ltd. (Redis Cloud)	Short-term store — holds recently answered questions, your sign-in session state, and work waiting to run in the background	United States · European Union	Short-lived cached answers and embeddings, session state and queued background jobs	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Cloudflare, Inc.	CDN / edge / DDoS protection fronting the public web surfaces (edge SSL termination only; no application data persisted at the edge), and Turnstile human-verification on sign-up where it is the configured captcha provider	United States · Global edge network	Web requests in transit (your IP address and the pages you load); on sign-up, the human-verification token and your IP address when Turnstile is in use	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Vercel Inc.	Custom-domain provisioning — registering and verifying the domain a firm chooses for its client portal; engaged only on deployments configured for custom domains	United States · Global edge network	The custom domain name your firm asked us to serve your client portal on, so the certificate and DNS records can be issued; no documents, messages or account records	Not applicable — No prompts, documents or search queries reach this party; it receives a domain name to provision and verify, and nothing else. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Functional Software, Inc. (Sentry)	Error monitoring and performance tracing for the backend API and the Legalyard AI web app	United States · European Union	Crash and error diagnostics (exception type, message and stack trace), HTTP route and status code, and performance span timing — never a request body, cookie, auth header, GenAI prompt or completion, or the arguments of a logged message	Not applicable — No prompts, documents or search queries reach this party; it receives crash/error diagnostic metadata and performance span timings, scrubbed of request bodies, cookies, auth headers, query strings, GenAI prompts/completions and the raw arguments of any logged message. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
PostHog Inc.	Product analytics (page views, feature usage) for the Legalyard AI web app	United States	Page-view and feature-usage events keyed to your account id — never your email, name, a document, a chat message, session replay, or the text/attributes of anything on the page	Not applicable — No prompts, documents or search queries reach this party; it receives product-analytics events (page views, feature usage) identified only by account id, with session recording, DOM text/attribute autocapture and clipboard capture disabled. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Payments2
Paddle.com Market Limited (Merchant of Record)	Payments — merchant of record for Legalyard AI subscriptions and credit packs bought on the web outside India; payment details are entered on Paddle-hosted checkout and never reach Legalyard	United Kingdom · United States · Ireland · Canada	Email address, invoice or business name, tax identifier, billing country and postcode; card details go to Paddle directly	Not applicable — No prompts, documents or search queries reach this party; it receives the billing identity needed to sell you a subscription and issue a tax invoice. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Razorpay Software Limited (payment aggregation by Razorpay Payments Private Limited)	Payments — checkout for Legalyard AI subscriptions and credit packs bought on the web from India; payment details are entered in Razorpay checkout and never reach Legalyard	India	Email address, invoice name and GSTIN; payment instrument details go to Razorpay directly	Not applicable — No prompts, documents or search queries reach this party; it receives the billing identity needed to take a payment and issue a GST invoice. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	DPDPA 2023 consent + cross-border transfer notice
Identity and sign-in4
Google LLC (Sign in with Google)	Identity — Sign in with Google and Google One Tap on the web and mobile apps	United States	Your Google sign-in happens with Google; Legalyard receives your email address, name and a stable account identifier from Google	Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in and the identity it returns. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Apple Inc. (Sign in with Apple)	Identity — Sign in with Apple on the web and mobile apps	United States	Your Apple sign-in happens with Apple; Legalyard receives your email address (or Apple relay address) and a stable account identifier from Apple	Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in and the identity it returns. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Microsoft Corporation (Microsoft Entra ID)	Identity — Sign in with a Microsoft account on the web and mobile apps	United States · European Union	Your Microsoft sign-in happens with Microsoft; Legalyard receives your email address, name and a stable account identifier from Microsoft	Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in and the identity it returns. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
LinkedIn Corporation (LinkedIn Ireland Unlimited Company for members in the EU, EEA, Switzerland and UK)	Identity and social publishing — Sign in with LinkedIn, and posting to LinkedIn when you connect your account and choose to share	United States	For sign-in: your email address and a stable account identifier returned by LinkedIn. For sharing: the text and link of the post you chose to publish, sent under the LinkedIn access you granted	Not applicable — No prompts, documents or search queries reach this party; it receives your sign-in identity and any post you explicitly choose to publish there. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Push notifications3
Apple Inc. (Apple Push Notification service)	Push notifications — delivery to iPhone and iPad apps, and to Safari for web push	United States	For the iOS app: your device push token and the notification title and text. For Safari web push: the browser push endpoint it issued to you and a notification payload that is encrypted to your browser before it leaves Legalyard, so the service cannot read it	Not applicable — No prompts, documents or search queries reach this party; it receives a device token and the notification text it is asked to deliver. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Google LLC (Firebase Cloud Messaging)	Push notifications — delivery to Android apps, and to Chrome and other Chromium browsers for web push	United States	For the Android app: your device registration token and the notification title and text. For Chrome web push: the browser push endpoint it issued to you and a notification payload that is encrypted to your browser before it leaves Legalyard, so the service cannot read it	Not applicable — No prompts, documents or search queries reach this party; it receives a device token and the notification text it is asked to deliver. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Mozilla Corporation (Firefox push service)	Push notifications — delivery to Firefox for web push	United States	For Firefox web push: the browser push endpoint it issued to you and a notification payload that is encrypted to your browser before it leaves Legalyard, so the service cannot read it	Not applicable — No prompts, documents or search queries reach this party; it receives a push endpoint your browser issued and an encrypted payload it cannot read. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Email delivery5
Amazon Web Services, Inc. (Amazon SES)	Email delivery — the primary outbound transport for every email Legalyard sends, engaged whenever this deployment has AWS credentials configured	United States · European Union · India	Your email address and the subject and full body of every email Legalyard sends you, including sign-in codes, password resets and payment receipts	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU SCCs + supplementary measures
Postmark (postmarkapp.com), operated by ActiveCampaign, LLC	Inbound email — receiving and parsing mail sent to a firm’s Legalyard assistant address, then handing it to the platform; engaged only on deployments configured to receive inbound mail	United States	Every message sent to your firm’s Legalyard assistant address: the sender’s address, the subject, the full body and any attached files	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses
The Rocket Science Group LLC d/b/a Mailchimp (an Intuit company) — Mailchimp Transactional	Email delivery — optional transactional email transport, engaged only on deployments where it is configured in the email route	United States	Your email address and the subject and full body of the email Legalyard sends you	Not applicable — No prompts, documents or search queries reach this party; it receives the emails it is asked to deliver to you. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Google LLC (Gmail / Google Workspace SMTP relay)	Email delivery — the generic SMTP relay, engaged only on deployments whose SMTP configuration points at Google, where it carries every message the primary transport does not	United States · Global — Google-operated data centres	Your email address and the subject and full body of every email Legalyard relays through it, including sign-in verification codes, password-reset links and payment receipts	Not applicable — No prompts, documents or search queries reach this party; it receives the emails it is asked to relay to you, which it holds in the sending mailbox. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	No cross-border transfer instrument — same jurisdiction, or a destination chosen by your own device
Zoho Corporation (Zoho Mail SMTP relay, India region)	Email delivery — the generic SMTP relay, engaged only on deployments whose SMTP configuration points at Zoho's India-region mail servers (zoho.in), where it carries every message the primary transport does not	India · India — Zoho-operated data centres (zoho.in region)	Your email address and the subject and full body of every email Legalyard relays through it, including sign-in verification codes, password-reset links and payment receipts	Not applicable — No prompts, documents or search queries reach this party; it receives the emails it is asked to relay to you, which it holds in the sending mailbox. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	DPDPA 2023 consent + cross-border transfer notice
Human verification1
Intuition Machines, Inc. (hCaptcha)	Human verification on sign-up where hCaptcha is the configured captcha provider	United States	The human-verification token from your device and your IP address	Not applicable — No prompts, documents or search queries reach this party; it receives a verification token and your IP address. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Social publishing1
X Corp.	Social publishing — posting to X when you connect your account and choose to share	United States	The text and link of the post you chose to publish, sent under the X access you granted	Not applicable — No prompts, documents or search queries reach this party; it receives only a post you explicitly choose to publish there. A content-retention posture therefore does not apply. How long it keeps what it does receive is set by its own published terms, which have not been read.	EU Standard Contractual Clauses
Other services1
Unsplash Inc.	Stock-image search for the document editor; engaged only on deployments configured for it	Canada · United States	The words you type when searching for an image, and a note that a particular image was used; none of your documents or account details	Provider's standard terms — no training restriction recorded; no zero-retention term recorded	EU Standard Contractual Clauses

Vulnerability Disclosure

We welcome good-faith security research. Report vulnerabilities to security@legalyard.com with reproduction steps and your contact details, or through the disclosure page at legalyard.com/security/disclosure.

Safe harbour

If you make a good-faith effort to comply with the rules below and report a finding responsibly, we will not pursue or support legal action against you under India IT Act §43/§66, the US Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990, or analogous laws.

Rules of engagement

Do not access or modify data that is not your own.
Do not degrade the Service for other users (no DoS, no rate-limit stress tests on production).
Do not test physical, social-engineering, or supply-chain vectors.
Give us reasonable time to remediate before public disclosure (90 days default).
Provide enough detail for us to reproduce and fix.

Our response

Acknowledgement within 2 business days
Initial triage within 5 business days
Status updates every 14 days until closure
Public credit on request after the fix is deployed

We do not run a paid bug-bounty programme today.

Frequently Asked Questions

Data handling

Where is my data stored?
Legalyard is established in India and the Service runs on cloud infrastructure. The hosting region is fixed by our deployment rather than chosen per user, and it is listed — with every other processor's region — in the sub-processor register in section 6. Model inference and retrieval happen at the providers named in the sub-processor register in section 6 of this page — Anthropic, PBC (United States), Google LLC (United States · European Union · India), OpenAI, LLC (United States · European Union), Cohere, Inc. (Canada · United States), Exa Labs, Inc. (United States), Perplexity AI, Inc. (United States), SuSea, Inc. (You.com) (United States) and Tavily Research, Inc. (United States). Only the prompt and the Content excerpts needed to answer it are sent at request time, except for these lanes, which send raw Content: audio, indexing, OCR, vision. Product analytics and application logs stay on our own infrastructure — we do not send them to a third-party analytics or error-tracking service; if that changes we will name the processor here and add it to the sub-processor register first. Every sub-processor and its location is listed in section 6.
How do I export or delete my data?
Sign in and visit Settings → Privacy. You can export your data (JSON, or a ZIP with a CSV per section — up to 3 exports per 24 hours, download link valid 7 days), file a verified erasure request that runs immediately, or delete your Account. Account deletion has a 30-day grace period you can cancel by signing in, with a reminder 7 days before; after that your data is removed and the account record is anonymised. The Privacy Policy lists exactly what survives an erasure and why (the erasure record and consent records, the sign-in security log, and de-identified abuse and payment records for the period required by applicable law). You can also email privacy@email.legalyard.com to file a Data Subject Request.
How do you handle subpoenas, court orders, and government requests?
We require valid legal process and assess every request for legality and proportionality. We push back on overbroad or unlawful requests, narrow scope where possible, and notify affected users where lawful. We publish summary transparency information for material categories of requests when they reach a critical mass.

Security

What happens if there is a data breach?
We follow a written incident-response runbook. If a breach is likely to result in risk to your rights and freedoms, we will notify the competent supervisory authority within the timeframe required by Applicable Law (72 hours under GDPR; 'as soon as possible' under DPDPA / CERT-In; without unreasonable delay under US state laws) and notify affected users without undue delay where the risk is high.
Can I get audit-log exports?
Account-scoped audit log exports are on the roadmap for the enterprise / Firm tier. Today, you can see your own signed-in sessions in Settings → Account; internally we keep product-usage and AI request logs for 90 days and sign-in activity for 12 months, and can produce evidence on request for legal-process or DPA-audit reasons.
Is my data encrypted?
Yes. Every connection uses TLS. Stored files are encrypted server-side (AES-256). Message text, conversation titles, extracted document text, push keys, and integration tokens are additionally encrypted at the application level with keys we manage. Session tokens are opaque and stored only as hashes.
Where do I report a security vulnerability?
Email security@legalyard.com with details, or use the disclosure page at legalyard.com/security/disclosure. We acknowledge within 2 business days, triage within 5 business days, and operate a safe-harbour policy for good-faith research that respects user privacy and avoids service disruption. We do not run a paid bug bounty today.

Compliance & certifications

Are you SOC 2 certified?
No. Preparation is under way — control evidence is captured in the platform against the trust criteria — but no assessor has been engaged, no audit period has run, and no report exists yet, so there is no readiness report or control-mapping we can send on request. We have not committed to a date, and we will not represent SOC 2 as attained until the report exists and can be produced. What we can send today is our Data Processing Agreement and the sub-processor register below — write to legal@email.legalyard.com.
Are you ISO 27001 certified?
No, and implementation has not started — the same is true of ISO 27701 for privacy and ISO 42001 for AI management. No assessor has been engaged for any of them and we have not committed to a date; we list them because reviewers ask, not to imply a timeline. Section 3 of this page states the security controls actually in force, which is what we are willing to be held to.

AI governance

Do you train AI models on my conversations?
No. Legalyard does not use your prompts, uploads, conversations, memories, or answers to train or fine-tune AI models, on any plan — there is nothing to opt out of. The one related choice is the 'Help improve Legalyard' switch in Settings → Privacy: when it is on, the edits and feedback you give on answers are kept for 90 days and used to improve answer quality, which does not train a model. Separately from what we do with your Content: your prompt, and the Content excerpts needed to answer it, are sent to the AI providers listed in section 6 of this page (Anthropic, PBC, Google LLC, OpenAI, LLC, Cohere, Inc., Exa Labs, Inc., Perplexity AI, Inc., SuSea, Inc. (You.com) and Tavily Research, Inc.). We have not recorded a no-training term with any of them — every one is recorded as running on its standard published terms. None is recorded as zero-data-retention. No vendor contract review is recorded yet, so we make no claim about terms we have not verified in writing — the provider cards in section 5 show the same thing. Some lanes do send raw Content rather than an excerpt — today: audio, indexing, OCR, vision.
How accurate is the AI?
Generative AI is probabilistic. Outputs may contain factual errors, fabricated citations, jurisdictional mismatch, or stale law. The Service is not a substitute for a licensed lawyer or qualified professional, and Outputs are not legal advice. Always verify Outputs with primary sources and a qualified professional before relying on them.

Business & procurement

Do you sign a Data Processing Agreement (DPA)?
Yes — for business customers and any controller-to-processor relationship. Our standard DPA includes the EU SCCs (June 2021) and the UK Addendum. Request a copy from legal@email.legalyard.com. Enterprise customers can negotiate.
Do you sign a HIPAA BAA?
No. We have no Business Associate Agreement to sign — none exists on any tier, and there is nothing we can send on request. If you handle protected health information, do not upload it to Legalyard AI. Write to legal@email.legalyard.com if a BAA is a requirement for you, so we know the demand is real.
Do you support SSO (SAML / OIDC)?
Federated OAuth sign-in (Google, Apple, LinkedIn, Microsoft) is supported on consumer tiers. SAML and OIDC SSO for enterprise / Firm tier are planned. Contact legal@email.legalyard.com for status and timeline.
Can my law firm use Legalyard AI?
Individual lawyers can use the consumer Service for personal research and learning, subject to the bar / professional-conduct rules of their jurisdiction (which may require client consent for using AI on client matter). For firm-grade use — multi-user workspaces, RBAC, SSO, audit logs, DPA, custom retention — please contact legal@email.legalyard.com about the firm SaaS tier (Legalyard for Business).
What's the difference between Legalyard AI (consumer) and Legalyard for Business?
Legalyard AI is the consumer product at legalyard.ai — individual accounts (sign-in required), India-INR / global-USD self-serve plans. Legalyard for Business is the firm SaaS — multi-user organisations, matters, billing, e-sign, client portal, RBAC, custom DPA, and a data-residency election recorded in that DPA. The two share the same backend platform but expose different surfaces and compliance commitments.

Contact Trust, Security & Compliance

Security. security@legalyard.com
Privacy / DPO. dpo@email.legalyard.com
Legal & contracts. legal@email.legalyard.com
Grievance (India). privacy@email.legalyard.com
Abuse. abuse@email.legalyard.com

See: Read the Privacy Policy

See: Read the Terms of Service

See: Sub-processor register

Not a Lawyer, and When We Refuse

Legalyard AI is a research and drafting tool, not a lawyer, and using it does not create a lawyer-client relationship. We do not claim to have solved hallucinations — the honest claim is narrower, and it is the one we can evidence: every claim in an answer is cited to a source you can open, cross-checked against it, and marked Verified, Review, or Unverified.

When a question cannot be grounded in a real source — because no citation supports it, because the jurisdiction cannot be established, or because the request calls for a definitive legal or financial decision only a licensed professional can make — Legalyard AI says so and declines, instead of guessing an answer that reads as confident.

The Unverified chip exists so the Verified chip means something: an answer with no reachable citation is labelled Unverified, not hidden.
A computed figure (an amount, a deadline, a fee) is calculated by a program and only narrated by the model — the model is never the source of the number itself.
Review every Output before you rely on it, and have anything consequential checked by a qualified lawyer or finance professional in your jurisdiction.

See: See how retrieval, grounding, verification, citation, and refusal work end to end

Trust, Security & Compliance

Trust at Legalyard AI

Compliance Programmes

EU GDPR / UK GDPR

India DPDPA 2023

CCPA / CPRA (California)

LGPD (Brazil)

PIPEDA + Quebec Law 25 (Canada)

APPI (Japan)

PDPA (Singapore)

SOC 2 Type II

ISO/IEC 27001

ISO/IEC 27701

ISO/IEC 42001

PCI-DSS

HIPAA

EU AI Act

India IT Act 2000 & SPDI Rules

CERT-In Directions 2022