Security Always on. Always secure.
Your data is in safe hands.
From encryption to access management, Asem enforces rigorous standards so your firm’s data stays secure, private and compliant.
Certifications & commitments
Asem is committed to meeting the most rigorous standards for security and data protection.
SOC 2 Type II
In progressWe are working towards SOC 2 Type II, an independent audit of our security controls over time. Ask us for the current status.
Ghana DPC
Registered with Ghana’s Data Protection Commission as required by the Data Protection Act, 2012 (Act 843).
EU data residency
Accra servers rolling outFirm documents and the application database are stored in the European Union. Servers in Accra, Ghana, are rolling out.
Encryption
TLS in transit, encryption at rest, and AES-256-GCM sealing for credentials and offline vaults.
No training on your data
Your firm’s content is never used to train AI models. AI runs through Asem’s own gateway.
Trusted data storage
- EU data residency
- Firm documents are stored in object storage restricted to the EU jurisdiction, and the application database runs in the EU. This transfer is disclosed in our privacy policy and engagement letters ask clients to consent to it. Servers in Accra, Ghana, are rolling out.
- Per-firm isolation
- Every record belongs to exactly one firm, and the firm is determined on the server from the signed-in user, never from what an app sends.
- No foundation-model training
- Your firm’s content is never used to train or fine-tune AI models.
- Encrypted offline copies
- Offline documents sit in an AES-256-GCM vault on each device and lock after 30 days without a check-in.
Legal-grade security
- Least privilege by design
- Role presets with person-level exceptions, checked on every request, and automated tests that fail if any endpoint is left ungated.
- Ethical walls
- Restricted matters stay hidden from people outside them, across documents, AI results, projects and connected drives.
- Sensitive sign-offs
- Conflict clearances, client-money approvals and document reclassification need the right person and a recorded reason.
- Tamper-evident records
- Client-money ledgers, e-signature envelopes, wet-ink executions and AI review decisions are hash-chained.
- Trusted infrastructure
- Asem runs on Cloudflare’s global network and a managed EU database, with secrets held in a dedicated secrets store.
Full ownership and flexibility
For firm data, your firm is the data controller and Asem Legal Software acts as its processor. Asem is designed around Ghana’s Data Protection Act, 2012 (Act 843): optional sensitive client details are only saved with the client’s recorded consent. Read our privacy policy, our list of sub-processors and our guide to Act 843 for law firms.
Your data. Your decisions.
You stay in control of your data at all times.
Data retention
Identity-verification records are retained to meet AML obligations; firms can request erasure of what the law allows.
Data governance
Audit logs show who accessed and changed what, and when, reviewed in Asem’s support console.
Encryption management
Credentials are sealed with envelope encryption under a key-encryption key held in a secrets store.
User authentication
Firm members sign in individually; firms can remove a person’s access instantly.
Proof, not promises
Every important action leaves a record.
Client-money ledgers, e-signature envelopes and wet-ink executions use hash chains: each entry includes a fingerprint of the one before it, so any later edit breaks the chain and is detectable. Read how on our engineering blog.
Reporting a security issue
If you believe you’ve found a vulnerability, email info@mail.asemlegal.com with the details. Please don’t access other firms’ data or disrupt the service while testing. Asem does not hold ISO/IEC 27001 or ISO/IEC 42001 certification today.
In short
Is Asem Legal secure?
Yes. Asem Legal is registered with Ghana’s Data Protection Commission and its SOC 2 Type II audit is in progress. It stores firm data in the European Union (with servers in Accra rolling out), encrypts it in transit and at rest, isolates each firm on the server, enforces role access and ethical walls on every request, and keeps tamper-evident audit trails.
FAQ
How does Asem encrypt data?
All traffic uses TLS, stored data is encrypted at rest, and payment-gateway keys, connected-drive credentials and offline vaults are sealed with AES-256-GCM, bound to the firm and object they belong to.
Can other firms see our data?
No. Every record belongs to one firm, and access is resolved on the server from the signed-in user, so one firm’s users can’t reach another firm’s data.
Can Asem staff read our documents?
Asem’s internal support tools are separate from the firm apps and access is restricted by role. Support works on the firm’s account settings and connections, not by browsing your matters.
Is our data used to train AI?
No. Your firm’s content is never used to train AI models. AI runs through Asem’s own gateway and respects the same access rules and ethical walls as everything else.
What happens if a laptop or phone is lost?
Offline documents on the device are encrypted and lock if the device hasn’t checked in for 30 days. Your firm can remove the user’s access at any time.
Where are you with SOC 2 Type II?
Our SOC 2 Type II audit is in progress. Email info@mail.asemlegal.com from your firm address for the current status and our security documentation, shared under a non-disclosure agreement.
Can our data be stored in Ghana?
Servers in Accra are rolling out. Today firm data is stored in the European Union; tell us if in-country storage matters to your firm and we’ll keep you posted.
Serious about security?
Book a demo to see Asem’s controls in action, and ask about our SOC 2 Type II progress.
