Security policy

At Despapeliza, security is not just a technical requirement: it is a core commitment present in every aspect of our platform, our processes and our culture. Our Security Policy is designed to protect the confidentiality, integrity and availability of our customers’ data, in full compliance with ISO/IEC 27001.

Core objectives of our Security Policy

Our Security Policy rests on the following pillars:

• Confidentiality: ensuring that information is accessible only to those authorized to access it.
• Integrity: safeguarding the accuracy and completeness of data and processing methods.
• Availability: ensuring that authorized users can access information and associated assets when they need them.

These principles guide every operational, technical and administrative security decision at Despapeliza.

Reference framework: ISO/IEC 27001

Despapeliza’s Security Policy is fully aligned with ISO/IEC 27001, the leading international standard for information security management systems (ISMS). Based on this framework, we have defined and implemented controls in the following key areas:

• Risk management: ongoing identification, assessment and mitigation of information security risks (clause 6.1.2, A.8.2).
• Access control: role-based access following the principle of least privilege (A.9.1, A.9.2).
• Cryptography: strong encryption standards for data at rest and in transit (A.10.1).
• Physical and environmental security: secure hosting environments with redundancy and disaster recovery protocols (A.11).
• Operations security: continuous monitoring, incident management and patching procedures (A.12).
• Supplier relationships: third-party due diligence and signed data protection agreements (A.15).
• Compliance and audits: regular internal audits and external assessments to validate their effectiveness (A.18).

Training and awareness

Security awareness is part of our company culture. Everyone on the Despapeliza team receives mandatory onboarding and annual training on information security policies, phishing prevention and data protection protocols. Our team members must formally acknowledge and comply with our internal security policies.

Continuous improvement

We see security as a living process, not a one-time setup. Our policies are reviewed at least once a year, or sooner if there are significant changes in the threat landscape, in our technology infrastructure or in the regulatory environment. This keeps us resilient, compliant and able to respond to new challenges.

Protecting our customers’ data

Every document, every transaction and every user interaction on the Legale platforms is governed by our Security Policy. This includes:

• End-to-end encryption of files and communications.
• Secure APIs protected with OAuth 2.0 and rate limiting.
• Complete audit trails and non-repudiation mechanisms.
• Multi-factor authentication and device fingerprinting.

Together, these controls protect our customers against unauthorized access, data loss and fraud.

By applying a rigorous Security Policy based on ISO 27001, Despapeliza ensures that your documents and personal data are always protected by industry best practices. Security is not just part of our platform: it is the platform.