Security

Last updated · November 2026

SettleIndex is built to handle confidential case data. We are independently certified to ISO/IEC 27001, the best-known standard for information security, cyber security and privacy protection.

Information security

ISO/IEC 27001 certified

A UKAS-accredited certification body has certified SettleIndex to ISO/IEC 27001. Certification includes periodic audits of our Information Security Management System (ISMS).

Independent penetration testing

A CREST-certified provider tests the application for security issues periodically.

Sign-in and access

You can sign in with passkeys, and multi-factor authentication is available. Enterprise accounts can use single sign-on.

Privacy by design

The application was built for sensitive and confidential information. Nothing is shared with other users unless you choose to share it, and our employees and contractors have no access to client data.

Your documents

We analyse uploaded documents only to create the litigation risk model. The documents are not saved or used for AI training.

Cloud infrastructure and data location

SettleIndex runs on Amazon Web Services, and your data is stored in AWS data centres in London.

Policies

Use of the application is subject to our terms of use. Our privacy policy covers data protection, and our cookie policy explains how we use cookies in the application and its support and analytics services.

Compliance

GDPR

SettleIndex complies with the UK and EU General Data Protection Regulation (GDPR), with a privacy by design architecture and clear privacy policies for visitors and users.

Data protection officer

The data controller is SettleIndex Ltd. Our Data Protection Officer is Robert Hogarth, who is also our representative in the EEA.

Data retention

We permanently remove the data associated with any account on request.

Reporting an incident

Please report security incidents to security@settleindex.com.