Security Commitment

This page describes how Lawgorithm approaches security and organisational controls during private beta. It covers our public marketing site and the design principles for the product platform. It is not a certificate, attestation, or third-party audit report. Capability badges below reflect design alignment and roadmap intent, not completed independent assurance unless expressly stated.

中文摘要（便于本地读者参阅）

效力与语言：本页以英文正文为准。以下中文仅为概要，不构成法律意见或与英文之间的正式翻译；如有歧义，以英文版本为准。

徽章表述：上方标签描述的是安全与合规方面的设计取向、控制目标与路线图，除已明确说明外，不表示已取得第三方认证或对监管机构的陈述结论。

数据驻留与基础设施：面向公众的静态营销站点部署于 Amazon Web Services ap-southeast-1（新加坡）区域；该站点不将访问者个人资料写入由本静态站点所运营的自有数据库。产品平台在设计上以新加坡数据驻留为默认方向，具体以正式客户条款及部署说明为准。

加密：传输加密以 TLS 1.2 为最低实践目标、优先采用 TLS 1.3；托管环境中静止数据采用符合行业惯例的对称加密方案（如 AES-256 类）；密钥与凭证轮换在基础设施层按策略执行。

隐私增强与架构：包括面向文档场景的脱敏与掩码能力设计、按工作空间与用户层级的访问控制思路、查询与操作的审计线索设计，以及对法律内容按特权/敏感信息处理的原则。

监管与指引对齐（设计层面）：在陈述与产品设计上参考新加坡《2012 年个人资料保护法》（PDPA）、新加坡金融管理局《技术风险管理指引》（MAS TRM）的常见期望；对欧洲经济区用户场景辅以与 GDPR 相称的技术与流程设计目标。

合规路线图：SOC 2 Type II 审计筹备中；ISO/IEC 27001 适用边界划定中；必要时开展 PDPA 语境下的数据保护影响评估（DPIA）或类似内部评估。

访问控制：私测阶段以邀请制为主；基础设施与管理面访问要求强认证（含 MFA）；遵循最小权限与职责分离的一般原则。

漏洞与依赖：持续跟进依赖组件更新；本营销站点为静态站点，无由本仓库实现的自有应用服务器执行面。

事件与个人数据泄露响应：若事件牵涉个人资料且可能构成 PDPA 下的可通报数据泄露，我们将在法定框架内尽快开展评估，并在切实可行的范围内尽快履行向个人资料保护委员会（PDPC）及受影响个人的通报义务（如适用），实际时间视事实、控制措施及法律意见而定。内部目标可能包括优先在数个交易日内完成初步评估，但不替代法律规定。

安全披露联络：请电邮至 contact@lawgorithm.sg，邮件主题请注明 Security Disclosure。我们将在合理期限内（通常为目标下一个新加坡工作日开始起计两个历日内发出收悉确认，遇公休日或大量报送时可能延长）予以回复；不构成对修复时限或法律后果的承诺。

1. Data residency and infrastructure

Static marketing site on AWS ap-southeast-1 (Singapore).
No Lawgorithm-operated application database on the static site for visitor-submitted content; contact is via mailto from the browser.
Product platform is designed with Singapore data residency as the default; customer-specific deployment terms apply when we engage commercially.

2. Encryption

TLS 1.2 minimum in transit; TLS 1.3 where supported.
Industry-standard symmetric encryption at rest (e.g. AES-256-class) in managed infrastructure.
Key and credential rotation governed at the infrastructure and secrets-management layer.

3. Privacy-preserving architecture

KAG-oriented anonymisation and masking patterns for document workflows.
Role-based access concepts per workspace and entitlement tier.
Audit trails for sensitive operations and queries where implemented.
Legal content handled with privilege-aware defaults in product design.

4. Regulatory alignment

We design controls with reference to:

Singapore Personal Data Protection Act 2012 (PDPA).
Monetary Authority of Singapore Technology Risk Management Guidelines (MAS TRM).
GDPR-appropriate patterns where EEA-facing processing is in scope.

Alignment is descriptive of intent and does not confirm completion of every supervisory expectation for every use case.

5. Compliance roadmap

SOC 2 Type II: audit engagement in preparation.
ISO/IEC 27001: ISMS scoping underway.
PDPA-relevant impact assessments: internal reviews on a need basis.

Enterprise prospects needing a security questionnaire or supplemental representations during private beta may contact contact@lawgorithm.sg. We provide factual materials where appropriate; bespoke sign-offs may be subject to legal and commercial terms.

6. Access control

Invite-led onboarding during private beta.
Multi-factor authentication required for privileged infrastructure access.
Least privilege and separation of duties as operational objectives.

7. Vulnerability management

Dependency and supply-chain hygiene tracked in development.
No server-side application runtime implemented by this static marketing repository.

8. Incident and breach handling

Security and personal-data incidents are triaged against Singapore’s PDPA notifiable data breach framework where applicable. Where notification to the Personal Data Protection Commission (PDPC) or affected individuals is required, we aim to act as soon as practicable under statute and internal procedures. Actual timing depends on facts, containment, forensics, and legal counsel. An internal objective may be to complete an initial triage within a few business days; that objective does not override legal deadlines or PDPC guidance.

9. Contact (security disclosure)

Email contact@lawgorithm.sg with subject line Security Disclosure. We target an acknowledgement within two calendar days from the next Singapore business day (excluding public holidays in Singapore and high-volume events), not a guarantee of remediation time or legal outcome.