Client confidentiality is non-negotiable. Ours is too.
Created for the professional obligations governing legal practice in Austria and Germany.
Firm isolation is built into the design.
Each law firm uses an isolated Alawyer workspace. Documents and analyses are kept in a separate encrypted environment, with no shared data layer between firms.
- Firm-level workspace isolation
- AES-256 encryption at rest
- TLS 1.3 in transit
- EU-hosted infrastructure (Frankfurt region)
Designed for the Berufsrechtliche Verschwiegenheitspflicht.
German and Austrian attorneys owe a professional duty of confidentiality. Alawyer enforces it with firm isolation, encryption, and controlled access.
No training on your data
Client documents uploaded to Alawyer are not used to train, fine-tune, or improve machine learning models. This commitment is included in the Data Processing Agreement.
EU-hosted data
Alawyer is hosted in Frankfurt, Germany, and no data leaves the European Union. Sub-processors with non-EU operations are contractually barred from accessing firm data.
GDPR Article 28 DPA for Team and Enterprise
Team and Enterprise subscriptions include a Data Processing Agreement compliant with GDPR Article 28. The DPA documents our role as data processor, the categories of data processed, and the technical-organizational measures in place. Solo subscribers can request a DPA by contacting [email protected].
Delete on demand
Documents and analyses can be permanently deleted on demand. Deletion cannot be reversed and is confirmed in an audit log. With no recovery option, no backup copy remains.
Security across the technology stack.
Encryption at rest
Documents and analysis results use AES-256 encryption at rest. Encryption keys rotate every 90 days.
Encryption in transit
All connections to Alawyer use TLS 1.3. Older protocol versions are disabled, and HTTP access is redirected to HTTPS.
Access control
Role-based access applies per firm workspace. Attorneys can be assigned to matters, and admin changes require email confirmation.
Audit logs
Uploads, analyses, and access events are logged with timestamps and user identities. Firms can export these logs, but firm administrators cannot delete them.
Infrastructure isolation
Alawyer uses a dedicated VPC. Law firms do not share a multi-tenant compute environment.
Vulnerability management
Critical and high-severity CVE patches are applied within 48 hours. Automated scans for known CVEs run weekly.
Frameworks relevant to German and Austrian firms.
Alawyer's security measures address the legal and data protection frameworks relevant to DACH law firms.
Full GDPR compliance with Article 28 DPA, data subject rights support, and documented retention and deletion schedules.
The Bundesdatenschutzgesetz applies to German law firms and covers professional secrecy holders.
The Austrian Datenschutzgesetz contains provisions specific to legal professionals and law firms.