Security at Banking Legal Ops

This page describes the security controls that are actually implemented in the Banking Legal Ops platform. Banking Legal Ops does not claim SOC 2, ISO 27001, GDPR certification or any other certification.

Authentication

Accounts sign in with email and password and must confirm their email address. Passwords must be at least 12 characters, and repeated failed sign-in attempts are rate-limited to resist brute-force attacks.

Two-factor authentication

Every account can add a time-based one-time password (TOTP) from an authenticator app, and platform administrator accounts are required to enable it. Enrollment is managed from the account security screen.

Encryption

Data is encrypted in transit with HTTPS/TLS between your browser and our servers. Documents, uploaded files and database records are encrypted at rest on the managed Postgres and object storage layer using AES-256 disk-level encryption; daily encrypted backups are retained by the same platform. We do not operate per-field client-side encryption, so platform administrators with database access can technically read stored document text.

Role-based access

Platform and organization roles are stored separately from user profiles and checked on the server. Administrative screens and administrative data are available only to users holding the corresponding role.

Row-level security

Database tables holding documents, templates, subscriptions and organization records enforce row-level security policies, so a query returns only the rows the signed-in user is entitled to read.

Organization data isolation

Documents and templates created inside an organization are scoped to that organization and, where configured, to a branch. Members of one organization cannot read another organization's records.

Server-side limit enforcement

Plan entitlements, document quotas and premium feature gates are evaluated on the server, so client-side changes cannot unlock features or exceed plan limits.

Secure payment processing

Subscription payments are processed by Razorpay. Card details are never stored in the application, and Razorpay webhooks are verified by signature before any subscription state changes.

File storage isolation

Uploaded templates and attachments are stored in per-user folders with storage policies that restrict access to the owning user, with administrative read access limited to platform administrators.

Audit trail

Key actions such as document generation, template changes and billing events are recorded so an organization can review activity.

Data usage

Documents and data you upload are used to operate the service for your account and organization. Banking Legal Ops does not sell customer data.

To report a security concern, email info@bankinglegalops.com.

Banking Legal Ops.