Security at Serverity

Serverity is hosted on AWS App Runner, which provides auto-scaling container hosting with built-in load balancing, TLS termination, and DDoS protection within the AWS eu-west-2 (London) region.

Our primary database runs on AWS RDS PostgreSQL, a managed Postgres service. All data is encrypted at rest using AES-256 and encrypted in transit using TLS. RDS provides automatic backups with point-in-time recovery.

File storage is provided by AWS S3, with all files encrypted at rest. Access to stored files is controlled via signed URLs with short expiration windows.

Serverity uses Google OAuth 2.0 as the sole authentication mechanism. This means:

• We never store passwords. Authentication is delegated entirely to Google.
• Sessions are managed using signed JWT tokens with a 30-minute session timeout.
• Session tokens are stored in secure, HTTP-only cookies with SameSite protection.
• Users benefit from Google's own security features, including two-factor authentication and suspicious login detection.

• In transit: All data transmitted between your browser and Serverity is encrypted using TLS 1.3. All API calls to third-party services (Anthropic, Stripe, AWS) are also encrypted via TLS.
• At rest: Database content is encrypted using AES-256via AWS RDS PostgreSQL's built-in encryption. Files stored in AWS S3 are encrypted at rest using provider-managed keys.

Serverity implements a layered access control model:

• Role-based access control (RBAC): Users are assigned roles (owner, admin, member) that determine their permissions within an organisation.
• Organisation-level data isolation: Each organisation's data is logically isolated. Database queries are scoped by organisation ID at the application layer and enforced via row-level policies.
• Matter-level ownership checks: Every request to access matter data is verified against the requesting user's role and matter membership. Users cannot access matters they are not assigned to.

Documents and queries are processed via the Anthropic Claude API, which is SOC 2 compliant. Our AI processing follows strict data handling principles:

• No model training: Your data is never used to train AI models. Anthropic's API terms explicitly prohibit training on customer data.
• Process and discard: Document content is sent to the AI provider for processing and is not retained by the provider after the response is generated.
• Pipeline safety: Our AI pipelines include circuit breakers that halt processing if anomalous behaviour is detected, preventing cascading errors or data leakage.
• Output cross-checking: AI outputs are subjected to a separate cross-check pass and authority verification against legislation.gov.uk and Find Case Law before being presented to users. This is a same-vendor automated cross-check, not a human-independent review.

Serverity implements comprehensive application-level security controls:

• Content Security Policy (CSP): Strict CSP headers prevent cross-site scripting (XSS) attacks by controlling which resources can be loaded.
• HSTS: HTTP Strict Transport Security ensures all connections use HTTPS.
• X-Frame-Options: Set to DENY to prevent clickjacking attacks.
• Rate limiting: API endpoints are rate-limited to prevent abuse and brute-force attacks.
• CSRF protection: Cross-site request forgery tokens are validated on all state-changing requests.
• Input sanitisation: All user input is validated and sanitised before processing to prevent injection attacks.

• Error tracking: Sentry provides real-time error monitoring and alerting across the application.
• Analytics: PostHog is used for product analytics and is hosted in the European Union, ensuring data does not leave the EU/UK adequacy zone.
• Pipeline circuit breakers: Our AI pipeline safety module includes circuit breakers that automatically halt processing when error rates exceed defined thresholds, preventing cascading failures.
• Audit logging: Key actions (login, data access, AI processing, data export) are logged for audit and incident response purposes.

• UK GDPR compliant: We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. See our Privacy Policy for full details.
• ICO registration: Registered with the Information Commissioner's Office (CSN9332107).
• Data Processing Agreement: A DPA is available on request for enterprise and corporate customers. Contact founder@serverity.ai.
• International transfers: Standard Contractual Clauses are in place for all US-based sub-processors (Anthropic, Stripe).

Legal documents and case files frequently contain special category personal data, privileged communications and third-party personal data. We treat that as the default processing case, not the exception.

• DPIA on request: We can share a Data Protection Impact Assessment template pre-populated for the AI-assisted legal-preparation use case. Suitable for adoption by your DPO or COFA.
• Lawful basis & data minimisation: Only data the user uploads or explicitly authorises is processed. AI providers receive document content for inference only and do not retain it after the response.
• Privilege awareness: Files are not used to train any AI provider's models. Privileged-document handling stays scoped to the matter.
• UK data residency: All persistent storage is in AWS eu-west-2 (London). AI inference is performed under DPAs with US sub-processors using Standard Contractual Clauses.
• DSAR & erasure: Self-service subject-access export is available; deletion requests are honoured per UK GDPR timelines.

Serverity is an AI-assisted preparation platform; it does not provide legal advice and does not replace a regulated provider's duty of care. Our liability framework is designed to be procurement-readable.

• Professional indemnity insurance: Maintained at a level appropriate to the platform's scope. Certificate available on request under NDA for enterprise procurement reviews.
• Liability cap framework: Standard contracts include a liability cap proportionate to fees paid, with carve-outs for breach of confidentiality, data-protection breaches and IP infringement, in line with UK enterprise SaaS norms.
• Regulatory boundaries: Outputs are AI-generated and must be reviewed by a qualified legal professional before use. Where the platform surfaces insurance, financial or regulated-product information, that information is indicative only and subject to the relevant authorisation status declared on each product page.
• Negotiated terms for enterprise: Master agreements (MSA + DPA + SOW) available for firm and in-house procurement. Contact founder@serverity.ai.

If you discover a security vulnerability in Serverity, we ask that you report it responsibly. Please email:

Please include a detailed description of the vulnerability, steps to reproduce, and any potential impact. We will acknowledge receipt within 48 hours and aim to provide an initial assessment within 5 business days.

We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and address it.

Serverity is designed to meet the controls of standard enterprise certifications. Our current state is below — updated as attestations are obtained. We publish honest progress rather than claim a certification we haven't completed.

Evaluating for enterprise procurement? founder@serverity.ai can share our SIG-lite questionnaire + current-state documentation under NDA.

We welcome security research conducted in good faith. Our full responsible disclosure policy, scope, rules of engagement, and safe-harbour clause are documented and linked below.

Policy last updated: 15 April 2026.