Independent Security Audit-Currently Underway
Our security program is built in accordance with the SOC 2 framework - a widely recognized standard created by the American Institute of Certified Public Accountants (AICPA). We are currently undergoing a formal SOC 2 Type II audit conducted by an independent firm. Once complete, the report will be available to customers and prospective clients under NDA.
Our Team & Policies
Outside Security Reviews
We don't just check our own work. Independent security firms evaluate our systems and practices to make sure our protections hold up.
Employee Training
Every team member completes security training covering topics like recognizing phishing attempts, protecting passwords, and handling data responsibly.
Confidentiality Agreements
All team members sign a confidentiality agreement before their first day. We also run background checks on every new hire in accordance with applicable laws.
Annual Security Testing
At least once a year, we hire an outside firm to try to find weaknesses in our systems - a practice known as penetration testing. This helps us stay ahead of potential threats.
Clear Ownership
Responsibility for protecting your data doesn't fall through the cracks. Every security-related role and duty is clearly assigned and documented.
Always Encrypted
Your data is encrypted when it's stored and when it's moving between your device and ours - meaning it's unreadable to anyone who shouldn't have access.
Continuous Monitoring
We actively scan for vulnerabilities and monitor our systems around the clock. If something looks off, our team is alerted immediately.
Backups & Recovery
Your data is regularly backed up so nothing is lost in the event of a hardware issue. We have monitoring in place to catch service disruptions quickly.
Incident Response
If a security incident were to occur, we have a documented plan with clear steps for containment, resolution, and communication - so you're never left in the dark.
Quarterly Reviews
Every quarter, we review who has access to what. If someone's role has changed or they no longer need access, permissions are adjusted or removed.
Password Management
All company devices include a password manager so our team uses strong, unique passwords for every service-reducing the risk of compromised accounts.
Annual Risk Reviews
At least once a year, we conduct a thorough review to identify potential risks to our organization and to your data - including fraud and emerging threats.
Step into the future.
See how EstateScribe is helping lawyers work faster, stay organized, and deliver a better client experience.