Security

Security contact: zacharie@goodlegal.fr.

Customer search queries and result payloads are not stored by Legal Data Hunter in our application database, dashboards, admin tools, or application logs. Query text may be transmitted to Scaleway, our hosted LLM inference and embedding provider in France/Europe, where needed to answer a request. Scaleway states that its Generative APIs apply Zero Data Retention by default: prompt, input, and output content is not collected, read, reused, analyzed, or used to train base models. Scaleway documents a narrow operational/security exception under which HTTP request content may be stored temporarily, for up to two weeks, to investigate abnormal errors, malicious activity, or security issues.

Controls

• Access to production systems is limited to authorized personnel.
• TLS encryption is used in transit.
• Backups are encrypted at rest where backups are maintained.
• API keys are stored hashed; plaintext keys are shown only once at creation.
• Production access controls and operational logging are used for security, abuse prevention, and debugging.
• Customer search queries and result payloads are not stored in the application database or exposed in dashboards, admin tools, or application logs; query text may be transmitted to Scaleway for hosted LLM inference/embedding where needed to answer a request.

Incident response

If Legal Data Hunter becomes aware of a personal data breach affecting business-customer personal data, we will notify affected business customers without undue delay, with a target notice period of 72 hours where legally required or provided under the applicable DPA.