Security
Every contract, agreement and compliance record indexed, searchable and retrievable in one repository. Security is not an add-on — it is the foundation of Legatio.
Independently audited and issued. Each certificate is published here in full rather than described.
Regulatory frameworks Legatio is built to meet. These are statements of compliance posture rather than third-party certifications, and are described that way deliberately.
Four controls that apply to every document on the platform, on every plan.
Legatio follows role-based access control and least-privilege principles. Access is restricted to each user's responsibilities: root administrators have full platform access, while operating administrators are limited to template upload and customisation and cannot reach stored documents. Every document, signing, upload and download action is recorded in an audit log.
Each corporate client's data is kept logically separate. Business users reach only the templates, packages, documents and records assigned to their organisation, and recipients reach only the documents sent to them, after authentication. Production, testing and development environments stay isolated so non-production work never touches live customer data.
Signed documents are held in a protected vault, reached through user permissions, authenticated sessions, secure document links and OTP verification for recipients. The platform keeps a document activity history covering access events, signing actions, downloads, timestamps, device and browser information, and IP address. Document data is encrypted in transit and at rest, with retention periods set by administrators against your own compliance obligations.
Legatio runs on hardened, regularly patched production infrastructure with restricted administrative access and secure network controls. External integrations — Aadhaar OCR and eSign, DSC signing, SMS and email delivery, eMSign — use authenticated APIs and protected webhook endpoints, and integration events are validated, logged and processed to preserve document integrity and a complete audit trail.
Named rather than described. Each is bound by a Data Processing Agreement compliant with the DPDP Act, 2023, the IT Act, 2000 and the CERT-In Directions, and processes data only on Legatio's documented instructions.
| Sub-processor | Function | Location |
|---|---|---|
| Digio | Aadhaar eSign, eKYC and DSC-based signing | India |
| Amazon Web Services | Platform infrastructure and encrypted vault hosting | India — Mumbai region |
| Jio TrueConnect | SMS and OTP gateway | India |
| AWS Simple Email Service | Transactional email delivery | India |
| PCI-DSS payment gateways | Payment processing — no card data is stored by Legatio | India |
A copy of any data processing agreement is available on request. No customer data is transferred, processed or stored outside India.
No Legatio employee has standing access to the contents of your documents. Documents are encrypted in transit and at rest and held in a segregated vault; access is role-based and least-privilege, requires an approved support or troubleshooting purpose, and every access event is written to the audit trail you can read. Root administrator access is restricted, logged and reviewed.
No, and this is a contractual commitment rather than a preference. Legatio does not use document content, user content or personal data for the training, fine-tuning or benchmarking of any artificial intelligence, machine learning or large language model. Nor is your data sold, rented or commercially transferred to anyone.
Administrators can revoke access immediately, without affecting the ownership or availability of company documents. All files, workflows and audit history remain under your organisation's control.
Legatio is designed for organisations where documentation is business-critical. ISO 27001 and ISO 9001 certification, enterprise-grade security controls, auditability, role-based access management and legally recognised digital signing workflows together cover the complete document lifecycle.
No. Once a document has been digitally signed, any modification changes its integrity and is detectable. Legatio keeps version history and audit records, so you always know what changed, when, and by whom.
No. Your documents remain your organisation's property. Legatio follows strict internal access controls, and customer data is not accessed without explicit authorisation for an approved support or troubleshooting purpose.
Legatio centralises your documents, maintains version control, records every activity through audit logs and provides secure storage. That significantly reduces the time spent locating records and preparing for an internal or external audit.
Security review documentation, data processing terms and the certificates above are available for your review.
Talk to our security team