# Legal AI agents: SOC 2, ISO 27001, GDPR and SSO

We checked 8 legal AI agents against their makers' own pages. 1 hold SOC 2, 1 hold ISO 27001, 5 state GDPR or offer a DPA and 5 offer SSO with no plan limit.

| Product | SOC 2 | ISO 27001 | GDPR / DPA | SSO | Checked |
| --- | --- | --- | --- | --- | --- |
| [AI Lawyer](https://agentsindex.ai/ai-lawyer) | Not checked | Not checked | Not checked | Partly | 2026-10-19 |
| [CoCounsel Legal](https://agentsindex.ai/cocounsel) | Not stated | Yes | Yes | Yes | 2026-10-26 |
| [Darrow](https://agentsindex.ai/darrow) | Not stated | Not stated | Yes | Partly | 2026-10-26 |
| [EvenUp](https://agentsindex.ai/evenup) | Yes | Not stated | Yes | Not stated | 2026-10-28 |
| [Harvey](https://agentsindex.ai/harvey-ai) | Partly | Partly | Partly | Yes | 2026-10-18 |
| [Legora](https://agentsindex.ai/legora) | Not stated | Not stated | Yes | Yes | 2026-10-26 |
| [Luminance](https://agentsindex.ai/luminance) | Not stated | Not stated | Yes | Yes | 2026-10-26 |
| [Spellbook](https://agentsindex.ai/spellbook) | Not stated | Not stated | Not stated | Yes | 2026-10-26 |

"Checked" is the oldest answer in the row. "Not stated" means the maker's pages don't say either way.

- **SOC 2**: Holds a SOC 2 report, Type I or Type II.
- **ISO 27001**: Is certified to ISO/IEC 27001.
- **GDPR / DPA**: States GDPR compliance or offers a data processing agreement.
- **SSO**: Lets a team sign in through its own identity provider (SAML or OIDC), with the plan it comes on.

## The "Partly" answers

- **AI Lawyer, SSO**: Sign-in works through Google or Apple identity as well as email, but no enterprise identity provider integration such as SAML or SCIM is documented for firm accounts. ([source](https://ailawyer.pro/docs/quick-start-guide), 2026-10-19)
- **Darrow, SSO**: Google account sign-in is the only identity provider Darrow's pages name for its services; no SAML, Okta or enterprise directory option is documented. ([source](https://www.darrow.ai/privacy-policy), 2026-10-26)
- **Harvey, SOC 2**: Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing. ([source](https://www.harvey.ai/security), 2026-10-18)
- **Harvey, ISO 27001**: Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing. ([source](https://www.harvey.ai/security), 2026-10-18)
- **Harvey, GDPR / DPA**: Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing. ([source](https://www.harvey.ai/security), 2026-10-18)

How we check listings: [methodology](https://agentsindex.ai/methodology/).

Source: AgentsIndex, https://agentsindex.ai/data/legal-ai-agents-security/