Augmetec

SECURITY AND TRUST

Investigations contain material that cannot leak, cannot be tampered with, and cannot be seen by the wrong people. LEIAA is built to keep it that way while still giving your team the access they need to work.

Visit our Trust Centre →Visit our Trust Centre ↗

ISO 27001Certified
SOC 2Certified
HIPAACompliant
UK & EU GDPRCompliant
EU AI ActCompliant

What protects a document in LEIAA

Follow a single piece of evidence from the moment it's uploaded to where it's stored.

Sign in
Your team signs in with SAML single sign-on through your identity provider, with two-factor authentication available.
In transit
Data travels over TLS 1.2 or above, both between your network and ours and within our network.
At the edge
Enterprise firewalls, intrusion detection, and DDoS, WAF, cross-site scripting and SQL injection protection stand in front of the platform.
In your instance
Your organisation has its own dedicated cloud instance, running inside a virtual private cloud.
At rest
Servers holding your data use AES-256 encryption, and data is backed up throughout the day.

Four commitments behind every environment

ISO 27001

Certified for comprehensive information security management across our systems and processes.

SOC 2

Certified with proven controls, including threat and intrusion detection, DDoS, WAF and SQL injection protection.

Contained

Dedicated environment in a region of your choice to comply with all data privacy, security and residency requirements, with granular least-privilege access.

Yours

Never used to train AI models, never shared with a third party. Managed by us or deployed in your own environment.

Security in detail

The controls behind each commitment.

Encryption and network

Material is encrypted in storage and in transit, behind layered network defences.

AES-256 at rest
Servers that hold customer data use AES-256 encryption.
TLS 1.2+ in transit
Between your network and ours, and within our network.
Network defences
Private cloud networking, firewalls, intrusion detection, and DDoS, WAF, cross-site scripting and SQL injection protection.
Secret management
Encryption keys and application secrets such as API keys and certificates are stored encrypted, with strictly controlled access.

Identity and access

Access is granular and least-privilege, for your team and for ours.

Single sign-on
SAML SSO with Active Directory and other enterprise identity providers.
Two-factor authentication
Available for users and for management access.
Controlled staff access
Only authorised Augmetec staff can reach secure parts of the system, and that access is audited.
Regular access testing
Access restrictions are tested at least every six months.

Auditability

Built to increase transparency and auditability across every investigation.

Keystroke-level audit log
Download a keystroke-level audit log directly from the platform.
You set user log retention
User audit data is kept for as long as you define.
12+ months of system logs
System and supplier activity logs are kept for at least 12 months.
Change management
All changes are tested, assessed and go through formal approval.

AI and your data

LEIAA's AI works on your investigation. Your data stays yours.

Never used for training
Your data is never used to train AI models.
Never shared
Your data is never shared with a third party.
EU AI Act compliant
LEIAA is compliant with the EU AI Act.
Privacy by design
LEIAA is built on privacy-by-design and security-by-design principles.

Resilience

Designed to keep live investigations running, whatever happens.

Backed up throughout the day
Recovery points are frequent, not nightly.
Across data centres
Auto-scaling across data centres, designed to stay online if one goes down.
Dedicated resources
Your own instance, so other customers don't affect performance. Outages are reported through a dashboard.
Disaster recovery
Backups are stored securely for an extended period, with rigorously tested disaster recovery procedures.

Security operations

Security is tested, reviewed and owned at board level.

Independent testing
External penetration testing at least once a year, plus frequent vulnerability scans and threat monitoring.
OWASP Top 10
Application security aligns with industry standards and mitigates the OWASP Top 10 vulnerabilities.
Continuous monitoring
Real-time monitoring of machine health, security and uptime, with any flagged events acted on quickly.
Board-level ownership
A named board-level person is responsible for service security.

Your data, on your terms, to the end

You can take your data with you whenever you want. When a contract ends, nothing is left behind.

Export or delete
Users can download or permanently delete their data through the platform, with CSV and PDF export.
Return
We can copy and return your data in a mutually agreed format.
Wipe
Once return is confirmed, your data is wiped from our systems.

Questions security teams ask us

Where is our data stored?

In a dedicated environment in a region of your choice, to comply with data privacy, security and residency requirements. LEIAA can also be deployed in your own environment.

Is our data used to train AI models?

Can we use our own single sign-on?

Who at Augmetec can access our data?

How is LEIAA tested?

What happens to our data if we leave?

Where can we find more security documentation?

Can we see your ISO 27001 Statement of Applicability?

Running a security review?

We'll walk your security, IT and procurement teams through our controls, and share the documentation you need.

Designed for the most sensitive information your organisation holds