Welcome to the Titan Fintech Trust Center! This portal provides an overview of our commitment to security and compliance. You can find our certifications, security practices, and explore details on our controls.

ISMS Statement of Applicability v4, January 5, 2024

Counsel AI complies with GDPR requirements as applicable, to protect the personal information of data subjects and consumers whose data is collected, stored, and processed by us or on our behalf.

Titan Fintech supports audit logs (only metadata, no content) and a workspace query history (including content).

Audit logs: Titan Fintech Application Audit Logs contain user and admin events, including event type, username, IP address, and user agent. The Titan Fintech Application Audit Log can be accessed through API and imported in customer's SIEM. Logged events include Login, Logout, data creation, data access, deletion, admin activity.

Workspace Query History: Your admin users can be granted permission to see a log of all queries through the admin dashboard, including: (i) User, identified by their email address (ii) Timestamp (iii) Type of query (e.g. Translation, Document Q&A, Redline, etc.) (iv) The query (v) The response.
This data can also be exported as an Excel file.
Administrators can also view the documents associated with the query in the admin dashboard.

Titan Fintech employs rigorous security measures to ensure the confidentiality, integrity, and availability of customer data.

In Progress: As of August 2024, there are no integrations generally available. In the future, Titan Fintech aims to integrate with popular document management systems, such as iManage and NetDocs, and with Microsoft SharePoint, to enable users to access and analyze their documents directly from their existing platforms.

All of our employees use phishing-resistant multi-factor authentication where feasible and identities are centrally managed. The Titan Fintech application supports SAML-based Single-Sign-On.

We follow the principle of least privilege and only grant users the minimum number of permissions required.

See https://www.titanfintech.com/legal for our full Support and Service Level Terms.

Titan Fintech supports SAML 2.0 for Single Sign-On. Please contact your account team for setup instructions.

The Titan Fintech Application includes team management features that allow for granular control over what each user can access and perform within the application.

Titan Fintech never asks for HIPAA data, such as medical records, and we expect customers to refrain from uploading such information.

All Customer Data and Content is securely deleted within 30 days of contract termination or upon request.

Data is encrypted at rest using AES 256 encryption.

We use TLS 1.2 or TLS 1.3 to encrypt data-in-transit.

By default, all processing and storage takes place in the United States, but we can accommodate customer requests for data storage in specific regions that are supported by our cloud service providers. For customers who have EU data residency requirements, we also have a service offering where all customer data is stored and processed in the European Union.

We are 100% cloud-based, and we utilize Microsoft Azure as cloud provider. Their data centers offer best in class physical security protocols.

We rotate encryption keys and important secret keys at least annually and utilize hardware security modules to safeguard critical encryption keys. Counsel AI logically separates encryption keys from Customer Data.

We accept responsible vulnerability disclosures at [email protected].

Titan Fintech is fully password-less. Users typically authenticate through Single-Sign-On with SAML. We also offer the option of email code authentication for customers who wish to not implement SAML, e.g., for a pilot.

Software developers are provided with secure development training at least annually.

Counsel AI follows application development security standards, such as OWASP, to ensure that applications are secured in every step of the development life cycle.

We perform continuous vulnerability scanning. We score and timely address vulnerabilities.

Titan Fintech uses a Web Application Firewall (WAF) to protect our application from common malicious web application attacks such as SQL injections and cross-site scripting.

Counsel AI mitigates the risk of unethical practices with robust anti-bribery, corruption, and fraud practices and policies, ensuring a transparent and compliant organizational culture.

We are committed to dealing fairly with our customers and competitors, and conducting our global activities in accordance with all applicable laws, including competition laws.

Counsel AI complies with all applicable laws and respects internationally recognized human rights where we operate, and expects the same of our partners. All labor must be voluntary. We don’t engage in child labor, forced, bonded, or indentured labor, involuntary prison labor, slavery, trafficking of persons, or physical punishment. We pay applicable legal wages under humane conditions.

Counsel AI's Code of Ethics is a formal set of principles and guidelines that govern the behavior of all employees. It serves as a compass for ethical decision-making, fostering a culture of integrity, transparency, and responsible conduct.

Fair labor practices encompass the ethical treatment of workers within an organization, ensuring that employees are treated equitably, paid fair wages, and provided with safe and humane working conditions.

Counsel AI has health and safety guidelines and procedures established to create a safe and healthy work environment.

Our Third Party Management policy describes our framework for selecting and validating all Suppliers we work with.

A whistleblowing program is a fundamental component of an organization's corporate governance structure, providing a confidential and secure channel for employees to report concerns or unethical behavior without fear of retaliation. This program encourages transparency, accountability, and the identification and resolution of issues that may impact the organization's ethical standards or legal compliance.

Counsel AI Corporation is a registered participant in the Data Privacy Framework (DPF). Where Customer Data contains personal data that is subject to the GDPR or UK GDPR, Customers can transfer personal data to Counsel AI in the United States, under the DPF. In the event the DPF is withdrawn, terminated, revoked, or otherwise invalidated, Counsel AI relies on the EU standard contractual clauses (SCCs) as a data transfer mechanism for EU personal data, and incorporates the SCCs as a standard part of its Data Processing Agreement (DPA). In the event there is a conflict between these obligations, Counsel AI Corporation will seek to resolve the conflict by following the most stringent or protective requirements, or by obtaining the explicit consent of the data subjects and consumers, or by consulting with the relevant authorities or stakeholders, as appropriate.

Please reach out to your sales representative if you are interested in signing a Data Processing Addendum (DPA).

Our Privacy Policy explains how Counsel AI and its Affiliates and subsidiaries collect, store, use, disclose, and otherwise process information about you in the course of our business. It also sets out important information about your privacy rights.

https://www.titanfintech.com/legal/privacy-policy

Please see our Support and Service Level Terms available at titanfintech.com/legal.

Our Privacy Policy describes Counsel AI's use of any applicable cookies.

In order to use Titan Fintech, users have to provide an email address. We also collect IP addresses and connection metadata for security purposes. Beyond this basic data, it is up to the user to decide which information to upload to Titan Fintech.

Please review our List of Subprocessors for up-to-date information on what customer data is shared with Third Parties.

Counsel AI has a designated DPO that is responsible for overseeing the privacy program and fielding any questions related to privacy. Email: [email protected].

We implement industry standard best practices such as RBAC, permissions based on the principle of least privilege, reviewing permissions frequently to identify any excessive or outdated permissions, and using Single Sign-On where possible to grant access based on pre-existing groups.

Counsel AI maintains an automated system to review and correlate log and behavioral events.

Counsel AI internal password policy is based on NIST SP-63. All systems with restricted data, including customer data, also require multi-factor authentication with phishing resistant credentials (e.g. FIDO2 security keys).

Counsel AI has deployed a solution to protect against denial of service attacks.

Formal business continuity procedures are developed and documented by Counsel AI Corporation. The purpose of these procedures is to prepare the organization in the event of service outages caused by factors beyond our control, and to restore services to the widest extent possible in a minimum time frame. The policy is reviewed and updated periodically to reflect relevant organizational changes, threats, risks, laws, regulations, and contractual requirements. The policy is also tested on an annual basis to ensure its effectiveness and alignment with our business objectives.

Titan Fintech uses widely trusted NTP servers, such as those operated by NIST.

Titan Fintech ensures the segregation of production data from test data.

We enforce full disk encryption on all employee-issued devices.

Endpoint Detection & Response (EDR) solutions help protect Titan Fintech's devices from malware and other threats.

Mobile Device Management (MDM) solutions allow our administrators to centrally manage mobile devices such as laptops and smartphones.

Titan Fintech has deployed threat detection solutions.

Our networks are segmented and utilize firewalls at strategic positions. We also utilize Web Application Firewalls (WAFs).

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are used to monitor for and prevent unauthorized access to the Counsel AI network.

Titan Fintech maintains a Zero-Trust network architecture. These tools are used to protect an organization's resources by using a combination of signals such as IP addresses, multi-factor authentication, user behavior, and more to determine if a user should be allowed access to an application or server.

All devices used to access our corporate networks and applications are centrally managed to enforce security policies, including device encryption, lock screen timeout, and password strength, and to deploy endpoint protection, detection, and response software.

We maintain policies and playbooks for incident response and test them at least annually. Our Security Addendum defines notification requirements in case of a security breach, see https://www.titanfintech.com/legal/security-addendum.

Our Acceptable Use Policy communicates our information security policies and outlines the acceptable use and protection of Counsel AI Corporation's information and assets. These rules are in place to protect customers, employees, and Counsel AI Corporation.

Our Access Control Policy limits access to information and information processing systems, networks, and facilities to authorized parties in accordance with business objectives.

The purpose of our Asset Management Policy is to identify organizational assets and define appropriate protection responsibilities. We ensure that information receives an appropriate level of protection in accordance with its importance to the organization and prevent unauthorized disclosure, modification, removal, or destruction of information stored on media.

Our Business Continuity Policy prepares Counsel AI Corporation in the event of service outages caused by factors beyond our control (e.g., natural disasters, man-made events), and to restore services to the widest extent possible in a minimum time frame.

Our Cryptography Policy ensures proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information. This policy establishes requirements for the use and protection of cryptographic keys and cryptographic methods throughout the entire encryption lifecycle. All encryption is performed in accordance with industry standards, including NIST SP 800-57.

Our Data Management Policy ensures that information is classified, protected, retained and securely disposed of in accordance with its importance to the organization.

Our Incident Response Plan establishes the plan for managing information security incidents and events, and offers guidance for employees or incident responders who believe they have discovered, or are responding to, a security incident.

Counsel AI Corporation has established an Information Security Management System ("ISMS") in accordance with ISO/IEC 27001 ("ISO 27001") that governs the processes required to protect company and information assets.

Counsel AI internal password policy is based on NIST SP-63. All systems with restricted data, including customer data, also require multi-factor authentication with phishing resistant credentials (e.g. FIDO2 security keys).

Counsel AI Corporation has adopted a standard format for use in the identification of risks, their classification, and evaluation based on NIST and ISO standards and frameworks.

Our Secure Development Policy ensures that information security is designed and implemented within the development lifecycle for applications and information systems.

Our Third Party Policy ensures the protection of Counsel AI's data and assets that are shared with, accessible to, or managed by suppliers, including external parties or third-party organizations such as service providers, vendors, and customers, and maintains an agreed level of information security and service delivery in line with supplier agreements.

Our Workplace Safety & Physical Security Policy contains standards to maintain a safe workplace that protects employee physical and mental health, and the security of Counsel AI information and offices. We are 100% cloud-based, and we utilize Microsoft Azure as cloud provider - their data centers offer best in class physical security.