01
Check who can access each matter
Test access, sharing and actions across the agreed application and user roles, so you can see where confidential material may be exposed.
Legaltech penetration testing
Get clear answers about
your legal software’s security.
Preparing for a release or a customer security review? We test matter access, document sharing and AI-connected permissions across legal software, client portals and firm workflows you control, so your team knows what needs attention.
Private, self-hosted AI assistance. Assessment material is not sent to third-party model providers for that assistance.
What your team gets
Testing focused on
your product and priorities.
Tell us what you’re releasing or what your customer has asked for. We’ll agree what to test, how your information is handled and what the report will cover.
02
The connected application
Include relevant APIs, integrations and permissions used by AI features in the authorised scope.
03
Findings your team can act on
Get findings from the agreed scope, practical guidance on fixes, a walkthrough of the results and a defined retest allowance.
UK + US buying context
The requirements behind
your customer’s review.
Start with the market your customer operates in. These guides help you identify the policy, assurance route and evidence request that apply to your product.
UK
Your UK buyer’s review.
SRA confidentiality duties, AI handling and applicable UK data-protection requirements. SRA references concern England and Wales.
US
Your US buyer’s review.
Lawyer confidentiality duties, AI supplier review and the governing state rules behind a customer’s request.
Illustrative assessment
See what an assessment
could look like.
A defined technical assessment can support different customer reviews. The actual buyer determines the required scope, evidence and provider conditions.
This proposed engagement uses fictional data. No completed customer work, findings or approval outcomes are claimed.
Legaltech / representative workflow
Matter files
Permissions
AI workflow
Illustrative scenario · Fictional data
A legal document workflow.
A buyer review ahead.
A proposed assessment of matter access, sharing and AI-connected permissions, using invented case files in an authorised test environment.
Before we begin
A few questions
to get you started.
Will the report satisfy our customer’s requirements?
We confirm the requested scope, report format and provider conditions before proposing the assessment. Your customer’s reviewer decides whether the resulting evidence meets its request.
Does private inference settle confidentiality or privilege?
No particular hosting model resolves all legal obligations. Private inference addresses the model-provider boundary; applicable lawyer duties, client instructions and the full processing arrangement still matter.
Do the same professional rules apply everywhere?
SRA references concern England and Wales. US lawyers’ governing state rules control. We scope to the actual buyer and client requirements.
Let’s talk through
your penetration test.
Tell us about your product, your deadline and the evidence your reviewer needs. We’ll agree the scope and handling arrangements before work starts.