Security and compliance
Legal AI agents: SOC 2, ISO 27001, GDPR and SSO
We checked 8 legal AI agents against their makers' own pages. 1 hold SOC 2, 1 hold ISO 27001, 5 state GDPR or offer a DPA and 5 offer SSO with no plan limit.
| Legal AI agents | SOC 2 | ISO 27001 | GDPR / DPA | SSO |
|---|---|---|---|---|
| AI LawyerChecked | Not checked | Not checked | Not checked | Partly |
| CoCounsel LegalChecked | Not stated | Yes | Yes | Yes |
| DarrowChecked | Not stated | Not stated | Yes | Partly |
| EvenUpChecked | Yes | Not stated | Yes | Not stated |
| HarveyChecked | Partly | Partly | Partly | Yes |
| LegoraChecked | Not stated | Not stated | Yes | Yes |
| LuminanceChecked | Not stated | Not stated | Yes | Yes |
| SpellbookChecked | Not stated | Not stated | Not stated | Yes |
"Checked" is the oldest answer in the row. "Not stated" means the maker's pages don't say either way.
- SOC 2
- Holds a SOC 2 report, Type I or Type II.
- ISO 27001
- Is certified to ISO/IEC 27001.
- GDPR / DPA
- States GDPR compliance or offers a data processing agreement.
- SSO
- Lets a team sign in through its own identity provider (SAML or OIDC), with the plan it comes on.
The "Partly" answers
- AI Lawyer, SSO: Sign-in works through Google or Apple identity as well as email, but no enterprise identity provider integration such as SAML or SCIM is documented for firm accounts. Source,
- Darrow, SSO: Google account sign-in is the only identity provider Darrow's pages name for its services; no SAML, Okta or enterprise directory option is documented. Source,
- Harvey, SOC 2: Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing. Source,
- Harvey, ISO 27001: Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing. Source,
- Harvey, GDPR / DPA: Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing. Source,
Use the data
How we check listings: methodology.