Security for your documents.
Your documents contain sensitive legal and business information. This page explains where Lawlift hosts them, how encryption works and what happens during AI-powered auto-templating and use of additional AI features.
Protected by default, not by request.
Case data used to generate documents from approved rule-based templates is encrypted on your device before it reaches our servers. Requests made during AI-powered auto-templating or by additional AI features run on EU infrastructure, under contracts that forbid training on your data. Every certification on this page is independently audited.
How we protect your documents.
-
Hosting & infrastructure
The application runs on servers in Germany, administered by Lawlift. AI processing takes place on EU infrastructure. Your data does not leave the EU.
-
Encryption - and what changes when AI is involved
When documents are generated from an approved rule-based template, your case data is encrypted on your device before it's transmitted - a zero-knowledge design where the decryption key never reaches our servers. AI-powered auto-templating and the additional drafting, editing and review features need to read the source document, so that content passes through our servers and AI providers for processing. It is not persisted once the task completes, and every connection is secured with TLS/SSL.
-
AI processing
Lawlift integrates AI models in line with the professional rules for lawyers: exclusively through Microsoft Azure and Amazon Bedrock, never directly through OpenAI's or Anthropic's own infrastructure, and with a data processing agreement (DPA) and an agreement under Section 203 of the German Criminal Code (StGB). Processing stays in the EU. Inputs and outputs are not stored after processing (zero data retention), are not seen by anyone outside Europe and are never used to train models.
-
Access control
Sign in with SSO via Microsoft Entra ID or OpenID Connect/OAuth. Two-factor authentication protects unrecognized devices. Four predefined roles, or your own custom roles, control exactly who can see and do what.
-
Compliance & contracts
Lawlift is GDPR compliant by design and ISO/IEC 27001 certified for information security management. A Data Processing Agreement is available as part of every contract.
Hosted inthe EU
Common questions
- Where is my data stored?
- On servers in Germany. AI processing happens on EU infrastructure - your data never leaves the EU.
- Does Lawlift train AI models on my data?
- No. We never train on your data, it is not persisted beyond completing the task, and our AI providers (Microsoft Azure OpenAI Service, AWS Bedrock) are contractually bound not to train on it either.
- Who can see my content during AI processing?
- AI processing runs with zero data retention: inputs and outputs are not stored after processing. It stays in the EU, and your content is not seen by anyone outside Europe. It is covered by a data processing agreement (DPA) and an agreement under Section 203 of the German Criminal Code (StGB).
- Is my data encrypted?
- When documents are generated from an approved rule-based template, your case data is encrypted on your device before transmission, a zero-knowledge design where the decryption key never reaches our servers. During AI-powered auto-templating and use of the additional AI features, document content passes through our servers and AI providers for processing, though it is not persisted afterward. Every connection is secured with TLS/SSL.
- Can I get a Data Processing Agreement (DPA)?
- Yes. A DPA is available as part of every contract - just ask your point of contact or reach out below.
- Is Lawlift GDPR compliant?
- Yes. Lawlift is GDPR compliant by design and ISO/IEC 27001 certified for information security management.
Have a security question we didn't answer?
Request our full security documentation or talk to our team directly.
Let’s talk!
Book a demoIn 20 minutes, we use one of your documents to show you how Lawlift handles it and which features help you most. Free and without obligation.
ISO/IEC 27001 certified · Hosted in Germany · GDPR compliant · No AI training on your data · Security and data handling