Start your security review
View & download public information Ask for information under NDA
Overview
Welcome to Wakili.pro's Trust Center. Our commitment to client confidentiality and data protection is embedded in how we build: attorney-client privilege comes first — nothing pools across firms, and client documents are never used to train our AI models. Use this Trust Center to understand our security posture and request access to security documentation.
Compliance
SOC 2 Type 2
In progressAudit in progress — not yet attained
ISO/IEC 27001:2022
In progressCertification in progress — not yet attained
Aligned to the Kenya Data Protection Act 2019. Reports will be shared under NDA once issued.
Documents
Get accessLegal · Public
Privacy Policy
Legal · Public
Terms of Use
Compliance · Gated
SOC 2 Type 2 report
In progress — available under NDA when issued.
Compliance · Gated
ISO/IEC 27001:2022 certificate
In progress — available under NDA when issued.
Encryption: what we encrypt, and what we don't
Security questionnaires usually ask this as a yes/no. It isn't one, so here is the full position rather than the flattering half of it.
Encrypted
- In transit — TLS on every public domain, HSTS with a two-year preload.
- Email account credentials — Fernet (AES-128-CBC + HMAC-SHA256) before storage. Never stored in the clear.
- Passwords — pbkdf2_sha256 with per-user salt; no reversibility.
- API keys — hashed at rest.
Not encrypted
- Matter documents and vault files — stored unencrypted in object storage.
- Database contents — no encryption at rest, no encrypted volumes, no field-level encryption on privileged text.
- Backups — rest in the same unencrypted storage.
What protects client data today is access control rather than cryptography at rest: row-level security keyed to your firm on every tenant table, role gates on privileged actions, and an append-only audit log of who touched what. That is a real control and it is real protection against the failure we actually face — one firm reaching another's data. It is not a substitute for encryption at rest, and we would rather say so than let a questionnaire answer stand in for the truth. Server-side encryption for document storage is on the roadmap; we will move this card to the left column when it ships.
AI & Citation Integrity
AI outputs on Wakili.pro do not constitute legal advice. Advocates remain responsible for verifying citations and exercising independent professional judgment. To support that duty, every AI work product passes through layered checks before it can clear review:
- Bidirectional citation gate. Every citation in the AI output must exist in the matter's citation ledger, and every ledger entry must appear in the output — with recorded source or pinpoint evidence. Unsupported or unsourced citations fail verification.
- Corpus cross-check. Before filing, drafts can be checked against our Kenyan legal corpus; cited authorities not found there are flagged for advocate review.
- Support scoring + human gate. Answers are scored for how well retrieved sources support them, with low scores triggering re-retrieval. Legal-advice outputs cannot clear review without passed citation verification by a human reviewer — and each run is sealed into a tamper-evident certificate recorded in the audit log.
These controls reduce — but do not eliminate — the risk of inaccurate citations. Independent verification by the instructing advocate is always required.
Risk Profile
Secure, reliable hosting our customers can depend on. We share details of our risk-mitigation practices and recovery objectives under NDA upon request.
Product Security
Role-based access control and reviewer-gated AI outputs. We share further details of our enterprise controls upon request.
Reports
Security-related reports, including SOC 2 and ISO/IEC 27001 materials, will be provided under NDA once issued.
Self-Assessments
We maintain internal security self-assessments and can provide completed questionnaires upon request.
Data Security
TLS in transit (Caddy, HSTS preload). Email account passwords encrypted at rest with Fernet (AES-128-CBC + HMAC). Document and database contents are not currently encrypted at rest — see below. Row-level security on every tenant table and an append-only audit log. Client data is never used to train AI models.
App Security
We take application security seriously: authenticated sessions, least-privilege roles, and audit-logged sensitive actions.
AI Governance
Citation verification gates, support scoring with re-retrieval, and mandatory human review for legal-advice outputs.
Legal
Kenya Data Protection Act 2019 alignment, published Privacy Policy and Terms of Use, regulator cooperation where required by law.
Access Control
Email/password authentication with secure sessions, firm-scoped tenancy, and role-based permissions. Nothing pools across firms.
Infrastructure
Cloud-hosted services with encrypted connections and continuous monitoring. Architecture details shared under NDA.
Policies
Published privacy and terms, internal data-handling policies, and a 6-year (2,190-day) default matter-document retention period. Retention windows are recorded per document, not purged on a timer.
Incident Response
Breach records carry a 72-hour notification deadline from confirmation, and the platform flags any that go overdue. Sending the notification is a manual step. Contact privacy@wakili.pro with any concern.
Contact
Security review requests: hello@wakili.pro · Privacy queries: privacy@wakili.pro. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).