Security

AskPanda holds the first thing a prospective client tells a law firm about their problem. We treat that information as confidential and potentially privileged from the moment it arrives. This page describes how we protect it. It expands on Annex 2 of our Data Processing Agreement and is written for the partners, compliance officers and IT staff who assess suppliers.

At a glance

1. Where your data lives

The AskPanda database and its backups are hosted by Amazon Web Services in its London region. Our own systems store client enquiry data only in the United Kingdom. A small number of sub-processors, such as our email delivery and AI providers, process data briefly in the EU or the United States under the safeguards described in our sub-processor list , and keep it only for as long as they need to perform their function.

2. Encryption

All traffic between your browser, the AskPanda platform and our sub-processors is encrypted with TLS 1.2 or higher. Data at rest, including the database and every backup, is encrypted using the cloud provider's managed encryption. Production secrets and API keys are kept outside source code and rotated when personnel change or exposure is suspected.

3. Access control

1. Your users. Every member of your firm has their own login and passwords are never stored in plain text. Multi-factor authentication is available to every user and we recommend it, but it is not mandatory and a user can turn it off, so your firm should ask its staff to keep it enabled. Firm administrators can add and remove users at any time and should remove leavers promptly.
2. Between firms. Every record is tagged to one firm and every query is scoped to that firm. One customer cannot see, search or be sent another customer's data.
3. Our staff. Access to production systems is limited to named individuals who need it to run the service and is logged. We do not read your enquiries except to resolve a support request you have raised or to investigate a security incident.

4. Artificial intelligence

AskPanda uses third-party large language models to process enquiry content. The provider is listed in our sub-processor list. Our arrangements with the provider:

1. prohibit the use of your data to train or improve any model;
2. limit the provider's retention of prompts and outputs to a maximum of 30 days, held solely for abuse monitoring and then deleted;
3. send only the content needed for the task, and never your account credentials or billing information.

We do not use your data, or any other customer's, to build our own models.

5. Backups and resilience

The database is backed up automatically every day. Backups are encrypted, kept for 7 days in the same UK region, and are not restored except to recover the service. Backup copies are overwritten in the ordinary backup cycle after data is deleted from the live system.

6. Monitoring, logging and retention

Application errors and security-relevant events, including failed sign-in attempts and account lockouts, are logged and monitored, and key actions on enquiry records are recorded in an audit trail. Logs are retained for up to 30 days and access to them is restricted to the engineering team.

You control how long enquiry data is kept. You can delete individual records at any time. When a subscription ends you have 30 days to export your data, after which we delete it within a further 60 days, including from backups, and confirm deletion in writing on request.

7. Incident response

We maintain a documented incident response procedure covering detection, containment, investigation, customer notification and post-incident review. If a personal data breach affects your data we will notify your account contact without undue delay and in any event within 72 hours of becoming aware, with the information you need to meet your own obligations to the ICO and to the individuals concerned. We will not contact your clients or a regulator about your data without your agreement unless the law requires it. To report a security concern, email support@legalpandas.com.

8. How we build the platform

All code is version-controlled and reviewed before release. Dependencies are updated to address known vulnerabilities. Staff and contractors are bound by written confidentiality obligations and receive data protection training.

9. Sub-processors

We assess every sub-processor before engagement and periodically afterwards, bind each by a written data protection contract, and give customers at least 30 days' notice before adding or replacing one. The current list, with locations and a change log, is published in Annex 3 of our Data Processing Agreement .

10. Assurance

We are registered with the Information Commissioner's Office under reference ZB193262. Customers may request a summary of our security measures once a year under clause 9 of the Data Processing Agreement, and may commission an independent audit on the terms set out there.

11. What we ask of your firm

Security is shared. To keep your enquiries safe, your firm should keep login credentials confidential and never share accounts, remove users who leave the practice, tell prospective clients in your own privacy notice that enquiries are handled with software that uses AI, review AI output before relying on it, and tell us at once if you suspect unauthorised access.

12. Questions

If your firm has a security questionnaire or due diligence process, send it to support@legalpandas.com and we will complete it.