Encryption in transit and at rest
All traffic between your firm, your clients, and Solicity is encrypted over TLS 1.2 or higher. Data stored in our database and document store is encrypted at rest using AES-256.
Security
How Solicity handles your clients' data.
Plain statements of fact. We will list certifications such as SOC 2 or ISO 27001 here only once we hold them.
Access control and per-party visibility
Every person attached to a matter sees only what their role permits. Buyer's solicitor, seller's solicitor, and client each have a distinct view. There is no shared inbox to misaddress.
Full audit logging
Every action against a matter — document uploaded, enquiry answered, status changed, party added — is timestamped and attributed to a named user. The audit trail is immutable and exportable.
UK data residency
Client data is stored and processed in the United Kingdom. We do not move client data outside the UK without explicit instruction.
GDPR posture for KYC and AML data
Identity documents and source-of-funds evidence are held under a documented retention schedule aligned to UK AML rules. Clients can request access, correction, or deletion in line with their rights under UK GDPR.
SRA-aware positioning
Solicity schedules and confirms money movements. It is not a system of record for client money. The solicitor's regulated client account remains the source of truth for funds held and released.
Questions for our security team — penetration tests, sub-processors, data-processing addendum, breach notification — are answered during your trial, before you commit to anything.