Trust Center

Technical and Organizational Measures (TOMs)

In accordance with Art. 32 GDPR, we are required to implement appropriate technical and organizational measures to ensure a level of protection commensurate with the risk. The following measures are implemented at LawFix.

1. Fundamental Measures (8/8 implemented)

Organizational foundations for data protection in accordance with GDPR.

• Data Protection Officer – Appointment of a company data protection officer (internal or external)
• Data Protection Management – Established internal data protection management system
• Employee Training – Regular data protection training for all employees
• Data Confidentiality Obligation – Written commitment of all employees to data confidentiality
• Data Protection Impact Assessment – Conducting DPIAs for high-risk processing activities pursuant to Art. 35 GDPR
• Incident Response – Documented procedure for reporting data breaches (72-hour deadline)
• Data Subject Rights – Processes for fulfilling access, deletion, and rectification requests
• Processing Register – Maintenance of a register of all processing activities pursuant to Art. 30 GDPR

2. Certifications & Compliance (5/5 implemented)

Verified security standards of the cloud infrastructure (Lovable Cloud).

• SOC 2 Type II – Certification for security, availability, and confidentiality
• ISO 27001:2022 – Certified information security management system
• GDPR Compliance – Full compliance with the EU General Data Protection Regulation
• EU Data Residency – Data processing exclusively in EU data centers (AWS eu-central-1)
• Data Processing Agreements – DPA contracts with all sub-processors

3. Access Control (5/5 implemented)

Measures to prevent unauthorized system access.

• Two-Factor Authentication – Mandatory 2FA for all user accounts
• Password Policy – Enforced password policy (minimum length, complexity)
• Session Management – Automatic session timeouts and secure token management
• Login Logging – Logging of all login attempts with timestamps
• User Management – Centralized user management with role-based access control

4. Authorization Control (5/5 implemented)

Ensuring that authorized users only access permitted data.

• Row Level Security (RLS) – Database level: Automatic filtering by user/company context
• Role-Based Permissions – Implemented roles and permissions concept (Admin, Member)
• Need-to-Know Principle – Minimum privilege assignment based on necessity
• Tenant Isolation – Strict logical separation of data between different companies
• API Authorization – JWT-based API authentication for all backend calls

5. Encryption & Transmission Security (4/4 implemented)

Protection of data during storage and transmission.

• TLS 1.3 – Encryption of all data transmissions with TLS 1.3
• Encryption at Rest – AES-256 encryption of all stored data
• HTTPS-Only – Enforced HTTPS connections for all endpoints
• Secure API Communication – Encrypted communication between frontend and backend

6. Availability & Recovery (5/5 implemented)

Protection against data loss and ensuring uptime.

• Multi-AZ Redundancy – Data replication across multiple availability zones
• Automatic Backups – Daily automatic database backups
• Point-in-Time Recovery – Restoration to any point in time possible
• Disaster Recovery – Documented disaster recovery plan
• Uptime SLA – Guaranteed availability according to service level agreement

7. Input Control & Logging (4/4 implemented)

Traceability of all data processing operations.

• Audit Logging – Complete logging of all database changes
• User Identification – Unique attribution of all actions to user accounts
• Timestamps – Automatic timestamps for all data changes (created_at, updated_at)
• Immutable Logs – Tamper-proof storage of log data

8. Data Processing & Sub-processors (4/4 implemented)

Control over third-party providers and their data protection standards.

• Sub-processor Management – Documented list of all sub-contractors with DPA
• EU Standard Contractual Clauses – SCCs for third-country transfers (if applicable)
• Regular Review – Annual review of sub-processor compliance
• Data Minimization – Sharing only data necessary for the assignment

Security Whitepaper

Comprehensive documentation of our security measures and standards.

Version 2.0 – January 2026

1. Executive Summary

LawFix provides companies with a modern, AI-powered compliance platform that integrates security from the ground up into all systems and processes. Over 2,500 pages of EU legal acts are already integrated into the platform and are automatically analyzed for each company's individual applicability.

2. Company Profile

LawFix is a smart SaaS solution for compliance management, specifically designed for companies affected by EU regulations.

3. Security Principles & Governance

Security is a core element of LawFix's corporate philosophy. Our goal is to ensure the confidentiality, integrity, and availability of all data at all times.

The security organization follows clearly defined responsibilities. Nico Zipse and Jasin Huber are designated as security officers.

LawFix maintains documented Technical and Organizational Measures (TOMs) pursuant to Art. 32 GDPR.

• SOC 2 Type II – Audited for security, availability, and confidentiality
• ISO 27001:2022 – Certified information security management system

4. Infrastructure & Network Security

The platform operates on a certified cloud infrastructure (Lovable Cloud / Supabase) with EU data residency.

Key infrastructure features:

• EU Data Centers – All data is processed exclusively in AWS eu-central-1 (Frankfurt)
• Multi-AZ Redundancy – Data replication across multiple availability zones
• TLS 1.3 Encryption – For all external connections
• Web Application Firewall – Protection against common attack vectors
• Automated Patch Management – Regular security updates

All systems are secured through strict network segmentation and access restrictions.

5. Application Security

The software architecture is based on a modern React frontend and a secure backend API via Supabase.

The implemented security mechanisms include:

• TLS 1.3 encryption for all external connections
• AES-256 encryption for data at rest
• Row Level Security (RLS) at database level
• JWT-based API authentication
• Automatic session timeouts
• HTTPS-only for all endpoints

6. Data Protection & Compliance

LawFix meets all requirements of the General Data Protection Regulation (GDPR). A data processing agreement (DPA) has been concluded with all sub-processors.

Data processing includes:

• Personal data (e.g., names, email addresses, user accounts)
• Business and sensitive compliance documents
• Usage and system monitoring metadata

Data encryption: At rest (AES-256), In transit (TLS 1.3). Backups: Automatic daily backups with point-in-time recovery. Data access rights are strictly assigned according to the least-privilege principle.

7. Access Control & Authentication

Access to systems is exclusively through secure, authenticated channels.

• Two-factor authentication (2FA) for all user accounts
• Role-based access control (RBAC) for users and services
• Automated session timeouts
• Logging of all login attempts

API access is controlled via secure JWT tokens and access restrictions. Tenant isolation is achieved through Row Level Security (RLS).

8. Monitoring & Incident Response

A documented incident response process is activated for security-relevant events:

• Detection and assessment of potential incidents through automated monitoring
• Prioritization and classification by severity
• Rapid response measures by the security team
• Documentation and root cause analysis to prevent future incidents

LawFix responds to security incidents in accordance with GDPR requirements (72-hour deadline) and promptly notifies affected users.

9. Business Continuity & Backup

LawFix uses the backup and recovery features of the cloud infrastructure:

• Automatic daily backups of the database
• Point-in-Time Recovery – Restoration to any point in time
• Multi-AZ Redundancy – Geographically distributed replication
• Disaster Recovery Plan – Documented disaster recovery plan

Availability is guaranteed through Service Level Agreements (SLAs).

10. Third-Party Providers & Sub-processors

LawFix exclusively uses established, vetted third-party providers with proven security standards.

Currently used sub-processors:

• Supabase (EU) – Database, authentication, storage
• AWS eu-central-1 – Cloud infrastructure
• Google Cloud Platform (EU) – AI services (Gemini for Advocati Chat)
• Stripe – Payment processing (with SCCs)
• Resend – Email delivery (with SCCs)

All third-party providers have corresponding data processing agreements (DPA).

11. Closing Remarks

Security is not a state but a continuous process. LawFix considers information security an integral part of its product development, infrastructure decisions, and organizational processes. Our commitment is to provide customers with the best possible balance of innovation, data protection, and technical security.

Sub-processors

List of all sub-contractors that process personal data as part of our services.

Contact & Responsible Parties

For questions regarding security, data protection, or compliance, our responsible parties are happy to assist you.

Security Reports

If you have discovered a security vulnerability, we kindly ask you to report it to us responsibly:

---

Resources