Legalica Security Infrastructure & Compliance

1.1 Full Technology Stack

The Legalica Platform operates exclusively on the following third-party infrastructure:

┌─────────────────────────────────────────────────────────────┐
│                    LEGALICA APPLICATION                        │
│              (Software Layer — Legalica's Control)           │
│  • Application code, business logic, AI orchestration        │
│  • User interface, API endpoints, data models                │
│  • Security rules, access controls                           │
└──────────────────────────┬──────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────┐
│              GOOGLE CLOUD PLATFORM (GCP)                      │
│         (Infrastructure Layer — Google's Control)            │
│                                                              │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐   │
│  │Cloud Firestore│ │Firebase Auth │ │Cloud Storage     │   │
│  │ (Database)    │ │(Authentication)│ │ (File Storage)  │   │
│  └──────────────┘ └──────────────┘ └──────────────────┘   │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐   │
│  │Cloud Functions│ │Cloud CDN     │ │Cloud Monitoring  │   │
│  │ (Serverless)  │ │ (Delivery)   │ │ (Observability)  │   │
│  └──────────────┘ └──────────────┘ └──────────────────┘   │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐   │
│  │Vertex AI      │ │VPC Firewall  │ │Cloud KMS         │   │
│  │ (AI/ML)      │ │ (Network)    │ │(Google-managed)  │   │
│  └──────────────┘ └──────────────┘ └──────────────────┘   │
│                                                              │
│  Physical Infrastructure: Google-owned data centers         │
│  Storage location: europe-west3 (Frankfurt, EU)             │
│  Transient compute: us-central1 (Iowa, US) — no Customer    │
│  Data persisted (see Section 7)                             │
└─────────────────────────────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────┐
│              THIRD-PARTY SERVICES (External)                  │
│                                                              │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐   │
│  │ Google Gemini│ │ Moonshot AI  │ │ Groq / Meta      │   │
│  │ (Primary LLM)│ │ (Kimi, #2)   │ │ (Llama 3, #3)    │   │
│  └──────────────┘ └──────────────┘ └──────────────────┘   │
│  ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐   │
│  │ Ollama       │ │ Creem        │ │ GLEIF            │   │
│  │ (Local, #4)  │ │(Merchant of  │ │ (LEI Data)       │   │
│  └──────────────┘ │ Record, MoR) │ └──────────────────┘   │
│  ┌──────────────┐ └──────────────┘                          │
│  │OpenCorporates│                                            │
│  │(Registry)    │  Note: Creem is an independent controller  │
│  └──────────────┘  (seller of record), not a subprocessor    │
└─────────────────────────────────────────────────────────────┘

1.2 What Legalica Controls vs. What Google Controls

2.1 Applicable Terms: Legalica's use of Google Cloud is governed by the Google Cloud Platform Terms of Service (cloud.google.com/terms). Key provisions affecting Platform users include:

2.2 Google's Limitation of Liability: Under the Google Cloud Terms:

2.3 Google's Disclaimer: Google does not make any warranty of any kind except as expressly agreed, is not responsible for the deletion of or failure to store Customer Data, and the customer is responsible for securing and backing up its application and customer data.

2.4 Google's Data Incident Policy: (a) Google will notify promptly after becoming aware of a Data Incident; (b) Google's notification is not an acknowledgment of fault or liability; (c) Google has no obligation to assess Customer Data for legal compliance; (d) Google will describe the nature of the incident and measures taken.

2.5 Google's Modification Rights: Google may: (a) update services with commercially reasonable changes; (b) modify terms with notice for material changes; (c) change SLAs with notice; (d) discontinue services with appropriate notice.

2.6 Google's Subprocessor Governance: Google: (a) maintains a public subprocessor list; (b) provides notice for new subprocessors; (c) remains liable for subprocessor acts and omissions; (d) ensures subprocessor contracts include equivalent data protection obligations.

2.7 Google's AI Terms: Under the GCP Service Specific Terms, Google will not use Customer Data to train or fine-tune any AI/ML models without the customer's prior permission or instruction.

3.1 Service Terms: Firebase Authentication is governed by: (a) Firebase Terms of Service; (b) Google Cloud Platform Terms of Service; (c) Firebase Data Processing and Security Terms.

3.2 Data Processing: Under Firebase Data Processing Terms: Google processes authentication data as a processor; SCC 2021/914 applies to international transfers; EU-US Data Privacy Framework certification applies; data may be processed anywhere Google maintains facilities unless data location is configured. Legalica has configured Firebase Authentication to process data in the EU (europe-west3).

3.3 Authentication Security: Firebase Authentication provides: (a) secure password hashing; (b) multi-factor authentication; (c) OAuth 2.0 integration with identity providers; (d) email verification; (e) password reset functionality; (f) brute force protection.

Legalica's Responsibility: Configuring Firebase Security Rules, enabling MFA, setting password policies, and monitoring for suspicious login patterns.

Google's Responsibility: Maintaining authentication infrastructure security, patching vulnerabilities in Firebase libraries, and providing service uptime according to Google's service level agreements.

4.1 API Integrations: Legalica utilizes API-level integrations with third-party Large Language Model (LLM) providers for processing text prompts and generating AI Output. These models do not run on Legalica's local hardware, but are queried as microservices.

4.2 Zero-Data Retention Policies: Legalica contractually enforces zero-data retention (ZDR) and no-training policies with LLM subprocessors to protect client confidentiality.

4.3 API Service SLAs: LLM providers do not guarantee 100% availability. Service interruptions on LLM provider APIs are handled by fallback mechanisms, routing queries to alternative providers where possible. Uptime and response speed for these elements are subject to third-party SLAs.

4.4 Multi-Provider AI Cascade:

The Platform uses a multi-provider AI inference cascade. Queries are routed through providers in the following priority order:

If a provider is unavailable, the system automatically falls back to the next provider in the priority list. Users are not notified of individual provider switches unless a complete cascade failure occurs. An EU-only routing option (excluding fallback providers located outside the EU) is available on request — see our Subprocessors page.

5.1 Registry Ingestion: To perform corporate intelligence, KYC mapping, and beneficial owner (UBO) tracing, Legalica queries public registries and company databases via encrypted secure APIs.

5.2 Data Integrity and Freshness: Information retrieved from registries is cached for performance optimization. Cached registry data is refreshed regularly.

6.1 Shared Responsibility Model: Similar to cloud provider models, liability on the Legalica platform is divided based on control. Legalica does not assume liability for infrastructure failures, model hallucinations, or user decisions made without independent verification. This Section is subject to Section 12 of the Terms of Service (including its mandatory exceptions for consumers, intent, gross negligence, and personal injury).

6.2 Responsibility Matrix:

7.1 EU Data Storage: Legalica operates on Google Cloud infrastructure in Europe. All databases and file storage are configured within the European Union (europe-west3 — Frankfurt). Certain serverless compute functions (Cloud Functions) execute in us-central1 (Iowa, USA) for specific workloads; no Customer Data persists in us-central1 — all structured data storage remains in the EU. See Section 7.2 for data flow details.

7.2 Data Transfer Flow

EU Data Subject ──► HTTPS (TLS 1.3) ──► Frankfurt GCP (europe-west3)
                                         │
                   ┌─────────────────────┴─────────────────────┐
                   ▼                                           ▼
         Vertex AI (EU region)                    Non-EU LLM Endpoints (US/China)
         • Zero retention                         • Zero retention, TLS 1.3
         • No training                            • No training, SCC 2021/914 + TIA

All Customer Data remains inside the Frankfurt region at rest. In transit, LLM queries route through secure pipelines to either EU Vertex AI locations or non-EU LLM provider endpoints under Standard Contractual Clauses (SCC 2021/914, where executed) supported by Transfer Impact Assessments (in finalization for the current fallback providers). An EU-only routing option is available on request (see our Subprocessors page).

8.1 Joint Detection and Escalation: In the event of a security incident originating on Google Cloud infrastructure or LLM provider networks, Legalica relies on notifications provided by the relevant provider.

8.2 Notification Timelines: If an infrastructure provider notifies Legalica of a data incident affecting customer data, Legalica will notify affected customers without undue delay, targeting 36 hours from provider notification.

9.1 Backup Systems: Cloud Firestore relies on Google Cloud's native multi-zone redundancy within europe-west3 (Frankfurt). On-demand snapshots can be initiated manually via the Firebase Console. Automated scheduled backup replication to a second region is planned but not yet implemented. We recommend that users regularly export important data through the Platform's export functions; Enterprise customers may request on-demand data exports for independent backup purposes.

9.2 Recovery Metrics:

• Recovery Point Objective (RPO): Dependent on Google Cloud Firestore native regional redundancy and last manual snapshot. No automated snapshot schedule is currently active.
• Recovery Time Objective (RTO): Dependent on Google Cloud platform recovery timelines and Firebase infrastructure restoration. Target: best effort within Google Cloud's SLA parameters.

Google Cloud may deprecate, modify, or update infrastructure features. Legalica is responsible for updating application code to adapt to Google Cloud API changes and ensure continuous service. Legalica will provide at least 72 hours' advance notice of planned (scheduled) maintenance, as set out in Section 11.5 of the Terms of Service.

To maintain the integrity of the technology stack, users must adhere to security best practices:

• Enable Multi-Factor Authentication (MFA) on accounts.
• Ensure browser software is updated to support secure TLS 1.3 encryption.
• Refrain from uploading unencrypted sensitive credentials to document workspaces.

12.1 Vendor Selection: Legalica conducts security reviews of all subprocessors in the infrastructure chain.

12.2 Subprocessor Governance Hierarchy:

Full subprocessor list with locations, purposes, and transfer safeguards: see the Subprocessors page in the Trust Center.

13.1 Legalica: Legalica does not currently hold SOC 2, ISO 27001, or similar certifications. An independent penetration test and a formal compliance program are planned; see our Security Overview for the current compliance posture.

13.2 Infrastructure Providers: Google Cloud's compliance documentation (including SOC reports and ISO 27001 certificates covering Google's infrastructure) is published by Google at its compliance resource center and is available to customers under Google's terms. These certifications cover Google's infrastructure, not Legalica's application.

13.3 Enterprise Requests: Enterprise customers may request available compliance and security documentation under a Non-Disclosure Agreement (NDA) via legal@legalica.app.

For questions regarding the infrastructure, technology stack, security systems, or data residency: