Trust Center

Technical and Organizational Measures (TOMs)

In accordance with Art. 32 GDPR, we are required to implement appropriate technical and organizational measures to ensure a level of protection commensurate with the risk. The following measures are implemented at LawFix.

1. Fundamental Measures (8/8 implemented)

Organizational foundations for data protection in accordance with GDPR.

• Data Protection Officer – Appointment of a company data protection officer (internal or external)
• Data Protection Management – Established internal data protection management system
• Employee Training – Regular data protection training for all employees
• Data Confidentiality Obligation – Written commitment of all employees to data confidentiality
• Data Protection Impact Assessment – Conducting DPIAs for high-risk processing activities pursuant to Art. 35 GDPR
• Incident Response – Documented procedure for reporting data breaches (72-hour deadline)
• Data Subject Rights – Processes for fulfilling access, deletion, and rectification requests
• Processing Register – Maintenance of a register of all processing activities pursuant to Art. 30 GDPR

2. Certifications & Compliance (5/5 implemented)

Security standards of the cloud infrastructure (Supabase) and our own organisation.

• SOC 2 Type II – Certification of the cloud infrastructure (Supabase) for security, availability, and confidentiality
• ISO 27001:2022 – Certification of the cloud infrastructure; LawFix's own information security is built to the requirements of the standard, without its own certification
• GDPR compliance – Processing in line with the EU General Data Protection Regulation
• Data kept within the European legal area – Database and files in Zurich (AWS eu-central-2). Switzerland is covered by an adequacy decision of the EU Commission. AI requests go to Google and are covered by standard contractual clauses; identifying details are replaced with placeholders beforehand.
• Data Processing Agreements – DPA contracts with all sub-processors

3. Access Control (5/5 implemented)

Measures to prevent unauthorized system access.

• Two-Factor Authentication – Mandatory 2FA for all user accounts
• Password Policy – Enforced password policy (minimum length, complexity)
• Session Management – Automatic session timeouts and secure token management
• Login Logging – Logging of all login attempts with timestamps
• User Management – Centralized user management with role-based access control

4. Authorization Control (5/5 implemented)

Ensuring that authorized users only access permitted data.

• Row Level Security (RLS) – Database level: Automatic filtering by user/company context
• Role-Based Permissions – Implemented roles and permissions concept (Admin, Member)
• Need-to-Know Principle – Minimum privilege assignment based on necessity
• Tenant Isolation – Strict logical separation of data between different companies
• API Authorization – JWT-based API authentication for all backend calls

5. Encryption & Transmission Security (4/4 implemented)

Protection of data during storage and transmission.

• TLS 1.3 – Encryption of all data transmissions with TLS 1.3
• Encryption at Rest – AES-256 encryption of all stored data
• HTTPS-Only – Enforced HTTPS connections for all endpoints
• Secure API Communication – Encrypted communication between frontend and backend

6. Availability & Recovery (5/5 implemented)

Protection against data loss and ensuring uptime.

• Multi-AZ Redundancy – Data replication across multiple availability zones
• Automatic Backups – Daily automatic database backups
• Point-in-Time Recovery – Restoration to any point in time possible
• Disaster Recovery – Documented disaster recovery plan
• Uptime SLA – Guaranteed availability according to service level agreement

7. Input Control & Logging (4/4 implemented)

Traceability of all data processing operations.

• Audit Logging – Complete logging of all database changes
• User Identification – Unique attribution of all actions to user accounts
• Timestamps – Automatic timestamps for all data changes (created_at, updated_at)
• Immutable Logs – Tamper-proof storage of log data

8. Data Processing & Sub-processors (4/4 implemented)

Control over third-party providers and their data protection standards.

• Sub-processor Management – Documented list of all sub-contractors with DPA
• EU Standard Contractual Clauses – SCCs for third-country transfers (if applicable)
• Regular Review – Annual review of sub-processor compliance
• Data Minimization – Sharing only data necessary for the assignment

Security Whitepaper

Comprehensive documentation of our security measures and standards.

Version 2.0 – January 2026

1. Executive Summary

LawFix provides companies with a modern, AI-powered compliance platform that integrates security from the ground up into all systems and processes. Over 2,500 pages of EU legal acts are already integrated into the platform and are automatically analyzed for each company's individual applicability.

2. Company Profile

LawFix is a smart SaaS solution for compliance management, specifically designed for companies affected by EU regulations.

3. Security Principles & Governance

Security is a core element of LawFix's corporate philosophy. Our goal is to ensure the confidentiality, integrity, and availability of all data at all times.

The security organization follows clearly defined responsibilities. Nico Zipse and Jasin Huber are designated as security officers.

LawFix maintains documented Technical and Organizational Measures (TOMs) pursuant to Art. 32 GDPR.

• Certified infrastructure – Operated on ISO 27001 and SOC 2 certified cloud infrastructure (Supabase, Zurich region)
• ISO 27001:2022 – Own information security built to the requirements of the standard, without its own certification

4. Infrastructure & Network Security

The platform operates on a certified cloud infrastructure (Supabase, Zurich region). Switzerland is covered by an adequacy decision of the EU Commission pursuant to Art. 45 GDPR.

Key infrastructure features:

• Data centre – Database and files reside in AWS eu-central-2 (Zurich); Switzerland is covered by an adequacy decision of the EU Commission
• Multi-AZ Redundancy – Data replication across multiple availability zones
• TLS 1.3 Encryption – For all external connections
• Web Application Firewall – Protection against common attack vectors
• Automated Patch Management – Regular security updates

All systems are secured through strict network segmentation and access restrictions.

5. Application Security

The software architecture is based on a modern React frontend and a secure backend API via Supabase.

The implemented security mechanisms include:

• TLS 1.3 encryption for all external connections
• AES-256 encryption for data at rest
• Row Level Security (RLS) at database level
• JWT-based API authentication
• Automatic session timeouts
• HTTPS-only for all endpoints

6. Data Protection & Compliance

LawFix meets all requirements of the General Data Protection Regulation (GDPR). A data processing agreement (DPA) has been concluded with all sub-processors.

Data processing includes:

• Personal data (e.g., names, email addresses, user accounts)
• Business and sensitive compliance documents
• Usage and system monitoring metadata

Data encryption: At rest (AES-256), In transit (TLS 1.3). Backups: Automatic daily backups with point-in-time recovery. Data access rights are strictly assigned according to the least-privilege principle.

7. Access Control & Authentication

Access to systems is exclusively through secure, authenticated channels.

• Two-factor authentication (2FA) for all user accounts
• Role-based access control (RBAC) for users and services
• Automated session timeouts
• Logging of all login attempts

API access is controlled via secure JWT tokens and access restrictions. Tenant isolation is achieved through Row Level Security (RLS).

8. Monitoring & Incident Response

A documented incident response process is activated for security-relevant events:

• Detection and assessment of potential incidents through automated monitoring
• Prioritization and classification by severity
• Rapid response measures by the security team
• Documentation and root cause analysis to prevent future incidents

LawFix responds to security incidents in accordance with GDPR requirements (72-hour deadline) and promptly notifies affected users.

9. Business Continuity & Backup

LawFix uses the backup and recovery features of the cloud infrastructure:

• Automatic daily backups of the database
• Point-in-Time Recovery – Restoration to any point in time
• Multi-AZ Redundancy – Geographically distributed replication
• Disaster Recovery Plan – Documented disaster recovery plan

Availability is guaranteed through Service Level Agreements (SLAs).

10. Third-Party Providers & Sub-processors

LawFix exclusively uses established, vetted third-party providers with proven security standards.

Currently used sub-processors:

• Supabase (Zurich, Switzerland) – Database, authentication, storage
• AWS eu-central-2 – Cloud infrastructure underlying Supabase
• Google (Gemini API) – AI services, paid tier with no training on customer data (with SCCs)
• Stripe – Payment processing (with SCCs)
• Resend – Email delivery (with SCCs)

A separate data processing agreement pursuant to Art. 28 GDPR is in place with every subprocessor; where a third country is involved, it rests on standard contractual clauses pursuant to Art. 46(2)(c) GDPR. For a current overview, write to [email protected].

11. Closing Remarks

Security is not a state but a continuous process. LawFix considers information security an integral part of its product development, infrastructure decisions, and organizational processes. Our commitment is to provide customers with the best possible balance of innovation, data protection, and technical security.

Sub-processors

List of all sub-contractors that process personal data as part of our services.

Contact & Responsible Parties

For questions regarding security, data protection, or compliance, our responsible parties are happy to assist you.

Security Reports

If you have discovered a security vulnerability, we kindly ask you to report it to us responsibly:

---

Resources