Generative AI, handled responsibly.
We partner with major AI providers for our generative AI needs. Client data is not used to train or tune AI models,
Certifications & compliance
Security certified.
CORTO is continuously audited to meet the standards your firm and clients expect.
SOC 2
Independent audit validating security controls against AICPA SOC 2 Trust Services Criteria.
SOC 3
Public-facing summary of our SOC 2 controls, shareable without an NDA.
CASA Tier 3
App Defense Alliance validating strong application layer security.
EU-US DPF
Certified under the EU-US Data Privacy Framework for lawful cross-border data transfers.
UK Extension to the EU-US DPF
Extension of the framework covering lawful data transfers from the UK.
Encryption
HTTPS/TLS in transit. AES-256 encryption at rest once data reaches CORTO's cloud infrastructure.
Cloud infrastructure
Hosted on AWS across multiple data centres in the Oregon region (us-west-2) for high availability.
Application security
Secure development practices, code scanning and reviews, annual external penetration testing.
24/7 monitoring
The CORTO environment is monitored around the clock, every day of the year.
Employee vetting
Staff with access to critical infrastructure undergo rigorous vetting, including background checks.
Compliance
SOC 2 and SOC 3 certified. EU–US Data Privacy Framework and UK Extension certified.
"AI is transforming legal practice, but firms will only embrace what they can trust. At CORTO, legal AI is secure by design, hardened against cyber threats, with client data guarded as seriously as privilege, so firms can innovate with confidence."
Yehan
Yehan Gunaratne
Head of Information Security
Frequently asked questions
Explore our Trust Centre for full documentation on our certifications and controls.
How does CORTO ensure client data confidentiality when using AI?
Through strong encryption in transit and at rest, zero training commitments from AI vendors, strict role-based access controls, and continuous logging and monitoring. AI providers are isolated and don't have direct access to CORTO's broader data environment.
How do you detect and prevent AI hallucinations?
Through regular internal audits of AI output quality, continuous monitoring for drift or unreliable behaviour, human review for high-risk use cases, and safeguards like prompt engineering and model constraints. Users are encouraged to independently verify AI outputs.
How is data segmented between customers?
Each customer's data is kept strictly separate — accessible only within the customer it belongs to, and never mixed with another customer's data, across CORTO's platforms.
How is my personal/sensitive information stored?
CORTO, Matter AI and Acctivity.ai are cloud-based solutions that store all client data on CORTO Systems, utilising the Amazon Web Services (AWS) platform in the US West (Oregon) region. AWS is a leading cloud provider known for its robust security measures, including advanced identity and access management, encryption, and DDoS protection. Your personal and sensitive information is securely stored using encryption-at-rest (AES-256). Access to your data within our organisation is tightly controlled and restricted to authorised personnel only. CORTO follows industry best practices to ensure data security while leveraging AWS's comprehensive security services.
What measures do you take to protect my data?
At CORTO, we implement a robust security strategy to ensure the confidentiality, integrity, and availability of your data. This includes industry-standard encryption, regularly scheduled vulnerability assessments, constant security monitoring, and strict access control policies. We utilise trusted cyber security tools for comprehensive threat identification and management. CORTO anonymises data, where possible, to reduce the sensitivity of the information collected. Data is classified and retained under CORTO's Data Classification, Handling and Retention Policy. Most user data is retained for seven years. However, matter documents uploaded to the platform are retained for 90 days.