We protect your data with the highest international standards

Compliance associated with information security

ISO 27001 provides controls for a comprehensive Information Security Management System (ISMS).

A-LIGN Compliance and Security, Inc. certifies that the organization operates an Information Security Management System that meets the requirements of ISO/IEC 27001:2022.

This certification supports that we apply rigorous security controls, audited processes, and a culture of continuous protection at every layer of our operation.

At Webdox, security isn't an add-on, it's part of the product's DNA. This certification assures our clients that their data and contracts are protected to the highest standards in the global market.

Compliance with information privacy

Webdox has been certified by A-LIGN Compliance and Security, Inc. in ISO/IEC 27701:2019, the first international standard that defines how to manage the privacy of personal information in a structured and responsible way.

This certification extends our security management system (ISO 27001) and incorporates specific controls to protect personal data in accordance with global frameworks such as GDPR (Europe) and LGPD (Brazil).

In addition, our applicability statement incorporates controls from the ISO/IEC 27018:2019 standard, which further strengthens the protection of personal data in cloud environments.

With this certification, Webdox provides its customers with a reliable CLM platform aligned with the highest international privacy standards, ideal for organizations that demand rigorous regulatory compliance and proactive protection of their data.

Compliance associated with the management of artificial intelligence systems

La ISO/IEC 42001:2023 is the first international standard to set out the requirements for a responsible and governed artificial intelligence management system (AIMS). Webdox has been certified by A-LIGN Compliance and Security, Inc., validating that we operate a system in compliance with this standard, reinforcing our commitment to the ethical, safe and transparent use of AI.

The scope of this certification applies to the AI processes and functionalities developed by Webdox as a vendor, including automated modules, recommendation engines, and machine learning-based flows within our Webdox CLM platform. All of this is implemented under principles such as equity, explainability, traceability and protection of personal data.

This management system is complemented by ISO/IEC 27001:2022 and ISO/IEC 27701:2019 controls, ensuring comprehensive coverage in information security and privacy in enterprise AI contexts.

Compliance associated with information security and confidentiality

SOC 2 Type II is an internationally recognized standard that assesses the operational effectiveness of controls related to the security, confidentiality, availability, and privacy of systems. Webdox has been audited by
A-LIGN Compliance and Security, Inc., obtaining the SOC 2 Type II report, which demonstrates that our processes meet the Trust Services Criteria defined by the AICPA.

This certification validates that Webdox has implemented and sustained rigorous controls to protect its customers' sensitive information over time, ensuring a secure and reliable environment. The SOC 2 framework reinforces our compliance with global standards such as GDPR and CCPA, and reflects our commitment to transparency and ongoing data protection.

Security and privacy in Webdox CLM Artificial Intelligence

Webdox CLM's Artificial Intelligence powers functionalities such as intelligent contract review, based on advanced generative Artificial Intelligence models. This solution has been designed under the highest standards of security, privacy, and governance, operating in an environment completely controlled by Webdox.

Key Protection and Compliance Aspects:

• Customer data protected by design: All information processed using AI capabilities remains within Webdox's secure environment, hosted on Google Cloud Platform. The data is always owned by the customer and is not used for model training, nor is it exposed to third parties.
• Controlled and dedicated infrastructure: Requests to OpenAI models are made through a private and dedicated Webdox environment, ensuring full control over the flow of data. OpenAI does not use the information for AI training.
• End-to-end encryption: All communications between internal and external components are carried out under TLS 1.2 or higher encrypted protocols.
• Ongoing security testing and monitoring: AI capabilities are audited as part of Webdox's cybersecurity program, including regular internal and external testing.

Security applied to our infrastructure on Google Cloud Platform (GCP)

Webdox operates on Google Cloud Platform (GCP), a world-class infrastructure that provides high levels of security, availability, and scalability for all of our services.

GCP has an architecture designed under the principle of defense in depth, integrating advanced controls of encryption, authentication, network segmentation and continuous monitoring. This platform complies with international standards such as ISO/IEC 27001, SOC 2, PCI-DSS, and FedRAMP, ensuring data protection and threat resilience.

Our GCP infrastructure allows us to manage environments securely, isolated, and efficiently, ensuring that our customers' data is protected against unauthorized access, information leaks, and operational risks.

Robust Architecture

Every great solution is backed by a great strategic partner. Google Cloud Platform, along with other recognized partners, provide us with all the security features that are required in the market.

• Webdox is a Google Cloud Partner, the infrastructure and security are inherited from Google services, with high availability in all its layers.

• Cloudflare, Gitlab, and New Relic are some of the services we use for the creation, use, and monitoring of Webdox.

• Systems designed for a 99.99% service level objective (SLO) and service level agreements (SLAs) are accommodated, usually at 99.5%.

• Backups run every 24 hours with a 30-day retention and failover replicas are activated improving High Availability. 

• Disaster Recovery Planning (DRP) with RTO (Recovery Time Objective) of 2 hours per service and RPO (Recovery Point Objective) of up to 24 hours.

• All metadata at rest is encrypted using AES 256.

• All metadata in transit is encrypted using TLS 1.2 or 1.3.

• Webdox has tools for monitoring and generating alarms in the event of anomalous events.

Secure Development

At the application level, Webdox has a series of security features that you can integrate with your technological infrastructure and if you want technical support we have a team of specialists who will solve all your queries. Today we rely on the good practices provided by OWASP (Top Ten) to deal with the most recurrent risks and we also work directly with ethical hackers for the continuous improvement of the application.

• User session parameter settings: Idle time, session duration, password format.
• Perimeter access management, it is configured from where it can be accessed and from where it cannot, through IP addresses.
• Single Sign On mechanisms via SAML V2.
• Integration with LDAP or SAML for user management.
• OAUTH integration through API and APP, providing robustness in the integrations that can be generated.
• Second factor of authentication.
• Access and permissions are controlled by roles assigned to users.
• Audit logs with all actions generated by users.
• DevSecOps across the development cycle.
• Identification of each internal process (UUID), granting a better operation and auditing of the platform.

Monitoring and Deployment

At Webdox we work the discovery of new vulnerabilities and their treatment, which is why we have the recurring and specialized service of different security providers for Pentesting and Ethical Hacking tests, working together to resolve the findings evidenced. This allows us to continue strengthening the service at the most demanding levels of the market. 

Additionally, our Technology and Security team plans annual backup recovery tests, to guarantee operational continuity times. Complemented by the Disaster Recovery Planning (DRP) for each of the critical systems, which together with the internal and external audits scheduled during the year, feed our continuous improvement process both at the Webdox process and product level.