Security
Ethical Hacking & Monitoring
Last Updated: Octubre 28, 2026At Legale, the protection of our clients’ information is a core pillar of our operations. To uphold the highest standards of cybersecurity, we implement a robust Ethical Hacking & Continuous Monitoring program that is directly aligned with our ISO/IEC 27001 Information Security Management System (ISMS). What is Ethical Hacking? Ethical hacking–also known as penetration testing–is the practice of simulating cyberattacks on our systems, applications, and infrastructure to identify and fix vulnerabilities before they can be exploited by malicious actors. These controlled tests are conducted under strict protocols, using industry-standard methodologies such as OWASP Top 10, NIST, and MITRE ATT&CK. The goal is to assess our defenses in real-world scenarios, such as: • Attempted access to unauthorized data • Exploitation of outdated or misconfigured services • Identity spoofing or session hijacking • API-level security breaches All findings are triaged and prioritized, and remediation actions are tracked through our internal incident management process. Why Continuous Monitoring Matters Security threats evolve daily. That’s why continuous monitoring is critical–not just scheduled audits. Our systems are under 24/7 surveillance, detecting: • Unauthorized access attempts • Anomalous login behavior • Misconfigurations or open ports • Emerging vulnerabilities in third-party dependencies This monitoring is done through both automated tools and human oversight, ensuring rapid detection and response to any incident. Our Partner: Intruder.io To maintain an unbiased and high-quality security posture, Legale partners with Intruder.io, a globally recognized cybersecurity platform specialized in proactive threat detection and vulnerability management. Intruder.io provides: • Continuous vulnerability scanning across all our assets • External and internal network assessments • Immediate alerting on new CVEs and zero-day vulnerabilities • Integration with DevOps pipelines for secure development practices By outsourcing this function to a specialized third party, we ensure our security is evaluated independently, with no blind spots or internal bias. This approach also demonstrates transparency and accountability to our clients and auditors. Alignment with ISO/IEC 27001 All our ethical hacking and monitoring practices are fully aligned with the controls outlined in ISO/IEC 27001, including but not limited to: • A.12.6.1: Management of technical vulnerabilities • A.16.1.4: Assessment of and decision on information security events • A.14.2.8: System security testing • A.15.1.1: Information security policy for supplier relationships Our ongoing ISO 27001 compliance ensures that risks are not only identified and mitigated, but also documented, reviewed, and continuously improved through our ISMS framework. By combining advanced internal controls with the independent oversight of Intruder.io, Legale delivers a security-first environment for managing electronic signatures, legal documents, and highly sensitive data–all in full compliance with international standards.
Security Policy
Last Updated: Octubre 28, 2026At Legale, security is not just a technical requirement — it’s a fundamental commitment embedded in every aspect of our platform, processes, and culture. Our Security Policy is designed to protect the confidentiality, integrity, and availability of customer data while ensuring full compliance with the ISO/IEC 27001 standard. Core Objectives of Our Security Policy Our Security Policy is built on the following pillars: • Confidentiality: Ensuring that information is accessible only to those authorized to have access. • Integrity: Safeguarding the accuracy and completeness of data and processing methods. • Availability: Ensuring that authorized users have access to information and associated assets when required. These principles guide all operational, technical, and administrative security decisions within Legale. Framework: ISO/IEC 27001 Legale’s Security Policy is fully aligned with ISO/IEC 27001, the leading international standard for information security management systems (ISMS). Through our adherence to this framework, we have defined and implemented controls across the following key areas: • Risk Management: Ongoing identification, assessment, and mitigation of information security risks (Clause 6.1.2, A.8.2). • Access Control: Role-based access with the principle of least privilege (A.9.1, A.9.2). • Cryptography: Use of strong encryption standards for data at rest and in transit (A.10.1). • Physical and Environmental Security: Secure hosting environments with redundancy and disaster recovery protocols (A.11). • Operational Security: Continuous monitoring, incident management, and patching procedures (A.12). • Supplier Relationships: Due diligence on third parties and signed data protection agreements (A.15). • Compliance & Audits: Regular internal audits and external assessments to validate effectiveness (A.18). Training & Awareness Security awareness is part of our company culture. All team members at Legale receive mandatory onboarding and annual training on information security policies, phishing prevention, and data protection protocols. Our employees are required to formally acknowledge and comply with our internal security policies. Continuous Improvement We believe that security is a living process, not a one-time setup. Our policies are reviewed at least annually — or sooner if significant changes occur in the threat landscape, technology stack, or regulatory environment. This ensures we remain resilient, compliant, and responsive to new challenges. Client Data Protection Every document, transaction, and user interaction on Legale is governed by our Security Policy. This includes: • End-to-end encryption of files and communications • Secure APIs protected by OAuth 2.0 and rate limiting • Full audit trails and non-repudiation features • Multi-factor authentication and device fingerprinting Together, these controls protect our clients from unauthorized access, data loss, and fraud. By adhering to a rigorous Security Policy based on ISO 27001 standards, Legale ensures that your documents and personal data are always protected by industry-leading practices. Security is not just part of our platform — it is the platform.
ISO/IEC 27001 – Our commitment to security
Last Updated: Octubre 28, 2026Discover Legale’s approach to ISO/IEC 27001, information security, risk management, controls and continuous improvement.