HAQQ Cloud
We run it, in the region you pick. Encrypted and isolated per firm: your data is kept separate and cannot be reached by other customers, even where infrastructure is shared.
Privileged material stays under your control.
Your matters never train a model, are hosted in the region you pick, and never touch another firm's data.
Compliant with
- SOC 2
- ISO 27001
- ISO 42001
- GDPR
Architecture
Security at every layer
Justinian runs as seven layers. The seventh is not a feature sitting on top of the other six - it is the boundary they all run inside.
- 7
Security & Governance
Ethical walls, residency and retention, wrapping all six.
- 6
Product & Interfaces
SSO, MFA and role-based access across every surface.
- 5
Legal Capabilities
Every action logged, attributable and exportable.
- 4
Context & Knowledge
One tenant per firm. No cross-matter mixing, ever.
- 3
Data & Integrations
Industry-standard encryption in transit, including TLS 1.3 where supported.
- 2
Justinian Agentic Harness
Guardrails, audit trails and configurable human approval for consequential agent actions.
- 1
Foundation Models
No training on your data. Customer-managed keys on Enterprise.
Privacy & data protection
How HAQQ replaces personal details
Before your conversation reaches an AI model
When you use HAQQ Legal AI Chat, personal details in your conversation are swapped for made-up stand-ins before anything is sent to an external AI model provider. The model works with the stand-ins. HAQQ puts the real details back before you see the answer.
You, in the HAQQ app
01You send a message
From the HAQQ app, over an encrypted connection (HTTPS).
HAQQ
02HAQQ receives your message
Your conversation is saved to your account. HAQQ's own systems check and prepare it.
HAQQ
03Personal details are replaced
Names, email addresses, phone numbers, street addresses, company names, and card and bank numbers become made-up stand-ins, and a stand-in name keeps the shape of the real one. Dates, countries, cities and jurisdictions stay: they decide which law applies, and when.
External AI model provider
Receives your personal details only as stand-ins
04The AI model answers
It works with the stand-ins, not the real details they replace.
HAQQ
05Real details are put back
HAQQ swaps the stand-ins back for your real details.
You, in the HAQQ app
06You see the answer
With your real details, over HTTPS.
An example
- You type
- Draft a termination letter for Rania Saleh, 12 Hamra Street, Beirut. Her email is rania.saleh@example.com.
- The AI model receives
- Draft a termination letter for Emma Clarke, 48 Oak Avenue, Beirut. Her email is j.miller@example.net.
- You see
- A draft letter addressed to Rania Saleh, 12 Hamra Street, Beirut.
Illustrative example with made-up people. Beirut stays as it is, because the city decides which law applies.
Where it happens
On HAQQ's servers, after your message arrives and before anything is sent to an external AI model. It does not run on your device.
If it cannot run
Your request is stopped rather than sent with your real details.
What it covers
Your messages, the documents you attach, and the information HAQQ looks up to answer you.
This is pseudonymisation: HAQQ keeps the link between each stand-in and the real detail, which is how it restores your answer. Your original conversation stays in your HAQQ account. Traffic between you, HAQQ and AI model providers is encrypted in transit (HTTPS).
Deployment & residency
Your data lives where you say
Three ways to run HAQQ and three regions to run it in. The platform is identical in all of them - only the boundary moves.
Private Cloud
Your own cloud tenancy. You hold the encryption keys, we operate the software inside your account.
On-Premise
Fully on-premise, on your own infrastructure. Your organization controls the infrastructure boundary.
Available regions: European Union, United States, Middle East
The frameworks we comply with
SOC 2
Controls designed and operated to align with the SOC 2 Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy. Not certified.
ISO 27001
The international standard for information security management systems (ISMS). HAQQ's controls are designed to align with it. Not certified.
ISO 42001
The international standard for AI management systems. HAQQ's controls are designed to align with it. Not certified.
GDPR Compliant
We meet GDPR obligations as a processor, including support for data subject rights and privacy protections.
Trust centre: privacy notice, DPA, sub-processors and compliance evidence
"Security isn't a feature we added, it's the foundation we built on. Legal professionals trust us with their most sensitive data, and we take that responsibility seriously every single day."
Antoine Kanaan
Co-Founder & CEO, HAQQ
Security FAQ
Where is my data stored?
Your data is stored in SOC 2 compliant data centers. You can choose your preferred region (EU, US, or Middle East) to meet data residency requirements. If residency is a contractual requirement, it is defined in your order form so your security team knows exactly where processing takes place.
Is my data used to train AI models?
No. Your data is never used to train our AI models. Your information remains exclusively yours.
How do you handle attorney-client privilege?
HAQQ is built so privileged material stays under your control: isolation per organization, encryption in transit and at rest, and access controls. Whether a given communication remains privileged is decided by your jurisdiction and your engagement terms, not by software.
What happens if there's a security incident?
We have a comprehensive incident response plan. If a breach affects personal data you control, we notify you without undue delay and use commercially reasonable efforts to send the initial notice as soon as practicable and, where feasible, within 72 hours.
Is HAQQ certified, or compliant?
Compliant, not certified. HAQQ's controls are designed and operated to align with the SOC 2 Trust Services Criteria, ISO 27001 and ISO 42001, and HAQQ meets its stated GDPR obligations as a processor. We describe this as compliance and alignment rather than claiming completed third-party certification. If certification is a mandatory procurement requirement for you, tell us early and we will confirm the exact scope in writing.
Can we manage our own encryption keys?
Yes. Enterprise customers can bring their own key and keep full control of the key lifecycle and rotation. Revoking the key ends our ability to read the data.
Can we run HAQQ in our own cloud, or on-premise?
Yes. HAQQ runs as a managed service in the region you choose, inside your own cloud tenancy, or fully on-premise. The product is the same in all three; what changes is who owns the perimeter.
How do you handle data retention and deletion?
You configure the retention period to match your regulatory obligations. Purging is automatic once it elapses and produces a verification log. You can export everything at any time.
Who at HAQQ can see our data?
By default, HAQQ personnel do not have access to customer matters. Access is governed through least-privilege controls and logging. Where support access to a specific matter is required, it needs your explicit approval and is time-limited.
Found a vulnerability? Read our disclosure policy and contact the security team. Responsible disclosure