Legal

Security at Eksana

Your Trust is Our Foundation. Our Security is Your Peace of Mind.

At Eksana, we recognize that legal data is among the most sensitive information. The confidentiality of your research, client details, and case strategies is not just a priority—it is the foundation of our service.

Below is an accurate, current description of how we protect it. We update this page as our security program matures.

Data Protection & Privacy

Encryption in Transit

  • All communication between your device and Eksana is encrypted using TLS 1.2 or 1.3.

Encryption at Rest

  • Files you upload are stored on cloud infrastructure that applies encryption at rest by default.
  • We do not currently apply additional field-level encryption to database contents (e.g., chat and research history stored in our application database). Strengthening this further is on our roadmap.

GDPR & Data Governance

Eksana is designed with GDPR principles in mind. Today, you can:

  • Rectify your account information at any time
  • Delete your account and associated data on request

A self-service tool to export a full copy of your data is planned but not yet available—until then, contact us and we will provide it manually.

*Note: Eksana follows GDPR principles but has not obtained third-party certification.

Infrastructure & Application Security

Cloud Infrastructure

  • File storage runs on cloud infrastructure from providers holding industry-standard compliance certifications (including SOC 2 Type II and ISO 27001).
  • Our application, database, and background-processing systems are operated and secured directly by our team.

Secure Software Development

  • Code changes go through review before release.
  • We run automated linting and static analysis as part of our build process.
  • We are actively expanding automated security and dependency scanning in our development pipeline.

Access Controls

  • API access requires authentication by default.
  • A small number of endpoints are intentionally open without authentication where necessary for the product to function—for example, login, account signup, and public case-law previews.
  • We are actively strengthening internal controls and audit logging around staff access to customer data, and will update this section as that work lands.

Operational Vigilance

Monitoring

  • We use application performance and error monitoring to detect and respond to issues in our platform.
  • We are building out more comprehensive security monitoring and alerting.

Incident Response

  • We are formalizing a documented incident response plan.
  • In the meantime, if you have a security concern, please contact us directly at [email protected] and we will respond promptly.

Your Partner in Security

We view security as a shared responsibility. While we continue to invest in platform-level protections, we encourage you to:

  • Use a strong, unique password
  • Stay vigilant against phishing attempts

*Note: Multi-factor authentication is not yet available on Eksana.