Security and certification.
Encrypted per business. Readable by no one at Legatio. Legatio's own staff cannot open a sent, signed or executed document, a filled value or a verification identifier. The administration system has no route to document content, and the build fails if one is added.
Encrypted per business. Readable by no one at Legatio.
- Built to the DPDP Act
- TLS 1.3 in transit; AES-256 at rest with a separate encryption key per business
- Executed documents in write-once storage; every download re-checks the hash
- Data, backups and a second copy all kept in India
- Independent penetration test before launch and every year after
- Consent, purpose and the sending business named at every OTP step
Certificates
The certifications and recognition behind Legatio. Issuer, scope and validity are as stated on each certificate.
ISO/IEC 27001:2022
Information Security Management System
- Scope
- Providing software information technology services
- Certificate no.
- 3050260703108IS
- Certified
- 3 July 2026
ISO/IEC 27701:2025
Privacy Information Management System
- Scope
- Providing information technology services
- Certificate no.
- UQ-2037113A1
- Certified
- 20 June 2026
ISO 9001:2015
Quality Management System
- Scope
- Providing software & information technology services
- Certificate no.
- E20260648667
- Issued
- 20 June 2026
Startup India
Certificate of Recognition
- Scope
- 'IT Services' industry, 'IT Management' sector, as self-certified
- Certificate no.
- DIPP272680
- Issued
- 16 July 2026
Need this for a vendor security review?
Send us your questionnaire and the team will come back with the answers it asks for.
Security questions
For your security review.
The short answers. If yours is not here, the team replies within one working day.
Ask us directlyTLS 1.3 in transit, and AES-256 at rest with a separate encryption key per business.
No. Legatio's own staff cannot open a sent, signed or executed document, a filled value or a verification identifier. The administration system has no route to document content, and the build fails if one is added.
Executed documents are kept in write-once storage, and every download re-checks the hash.
Yes. An independent penetration test before launch and every year after.