HAQQ Cloud
We run it, in the region you pick. Encrypted, isolated per firm, nothing pooled between customers.
Privileged stays privileged.
Your matters never train a model, never leave the region you choose, and never touch another firm's data.
Compliant with
- SOC 2
- ISO 27001
- ISO 42001
- GDPR
Architecture
Security at every layer
Justinian runs as seven layers. The seventh is not a feature sitting on top of the other six - it is the boundary they all run inside.
- 7
Security & Governance
Ethical walls, residency and retention, wrapping all six.
- 6
Product & Interfaces
SSO, MFA and role-based access across every surface.
- 5
Legal Capabilities
Every action logged, attributable and exportable.
- 4
Context & Knowledge
One tenant per firm. No cross-matter mixing, ever.
- 3
Data & Integrations
AES-256 at rest, TLS 1.3 in transit, on every connection.
- 2
Justinian Agentic Harness
Guardrails and human review on every agent action.
- 1
Foundation Models
No training on your data. Bring your own encryption key.
Deployment & residency
Your data lives where you say
Three ways to run HAQQ and three regions to run it in. The platform is identical in all of them - only the boundary moves.
Private Cloud
Your own cloud tenancy. You hold the encryption keys, we operate the software inside your account.
On-Premise
Inside your own building, on your own hardware. Nothing crosses your network boundary.
Available regions: European Union, United States, Middle East
The frameworks we comply with
SOC 2
Compliant with the SOC 2 framework for security, availability, processing integrity, confidentiality, and privacy of customer data.
ISO 27001
International standard for information security management systems (ISMS), demonstrating systematic approach to managing sensitive data.
ISO 42001
Compliant with the ISO 42001 standard for AI management systems, ensuring responsible and ethical AI development and deployment.
GDPR Compliant
Full compliance with EU General Data Protection Regulation, ensuring data subject rights and privacy protections.
Trust centre: privacy notice, DPA, sub-processors and compliance evidence
"Security isn't a feature we added - it's the foundation we built on. Legal professionals trust us with their most sensitive data, and we take that responsibility seriously every single day."
Antoine Kanaan
Co-Founder & CEO, HAQQ
Security FAQ
Where is my data stored?+
Your data is stored in SOC 2 compliant data centers. You can choose your preferred region (EU, US, or Middle East) to meet data residency requirements.
Is my data used to train AI models?+
No. Your data is never used to train our AI models or any third-party models. Your information remains exclusively yours.
How do you handle attorney-client privilege?+
Our platform is designed to maintain attorney-client privilege. Data isolation, encryption, and access controls ensure privileged communications remain protected.
What happens if there's a security incident?+
We have a comprehensive incident response plan. You'll be notified within 72 hours of any incident affecting your data, per GDPR requirements.
Is HAQQ certified, or compliant?+
Compliant. Our controls are designed and operated to align with the SOC 2 Trust Services Criteria, ISO/IEC 27001 and ISO/IEC 42001, and we meet GDPR obligations as a processor. We describe that as alignment rather than a completed third-party certification, and we will confirm the exact scope in writing for your procurement team.
Can we manage our own encryption keys?+
Yes. Enterprise customers can bring their own key and keep full control of the key lifecycle and rotation. Revoking the key ends our ability to read the data.
Can we run HAQQ in our own cloud, or on-premise?+
Yes. HAQQ runs as a managed service in the region you choose, inside your own cloud tenancy, or fully on-premise. The product is the same in all three; what changes is who owns the perimeter.
How do you handle data retention and deletion?+
You configure the retention period to match your regulatory obligations. Purging is automatic once it elapses and produces a verification log. You can export everything at any time.
Who at HAQQ can see our data?+
Nobody, by default. Access is role-based, least-privilege and logged. Support access to a specific matter requires your explicit approval and expires on its own.
Found a vulnerability? Read our disclosure policy and contact the security team. Responsible disclosure