LEGORA
Legora for Slack is the front door to your legal team.Anyone in your company can raise a request with legal from the Slack channel they already use. No form to fill in, no new tool to learn, and no Legora licence needed to ask.
From there, the Legora Agent takes over. It reads the request, asks the follow-up questions a lawyer would ask, and routes it to the right legal team as tracked work in Legora. The requester sees what’s been raised and where it stands.Then the work gets done. The Legora Agent prepares it using your legal team’s own Skills, playbooks and precedents. Routine requests, such as a standard NDA or a security questionnaire, can be handled end to end. Complex ones are prepared for a lawyer to review. Either way, a lawyer stays accountable for what goes back.
From there, the Legora Agent takes over. It reads the request, asks the follow-up questions a lawyer would ask, and routes it to the right legal team as tracked work in Legora. The requester sees what’s been raised and where it stands.Then the work gets done. The Legora Agent prepares it using your legal team’s own Skills, playbooks and precedents. Routine requests, such as a standard NDA or a security questionnaire, can be handled end to end. Complex ones are prepared for a lawyer to review. Either way, a lawyer stays accountable for what goes back.
LEGORA will be able to view:
LEGORA will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Privacy & data governance
Data retention policy
Subscriber Content is retained for the duration of the agreement, in line with the retention instructions given by the customer. After termination or expiry, Legora assists with retrieval of Subscriber Content for 30 days and then securely deletes all remaining Subscriber Content using industry-standard data destruction practices, unless applicable law requires retention. Written confirmation of deletion is provided on request. Critical security logs are retained for at least 12 months.
Data archiving and removal policy
At the customer's choice and instruction, Legora deletes or returns all personal data when the data processing agreement ends, and deletes Subscriber Content on written request. If Legora is legally required to keep archival copies (for example for tax purposes), it informs the customer, uses the copies only to meet that obligation, and keeps them under the same confidentiality and security obligations. Production backups are taken every 4 hours and are encrypted in transit and at rest.
Data storage policy
Customer data is stored in Microsoft Azure in the customer's assigned region (EU, US, Asia-Pacific or Australia). Files that are indexed for search are held by our search infrastructure provider, as listed on our sub-processor page. Data is encrypted with AES-256 (or equivalent) at rest and TLS 1.2 or higher in transit. Customer environments are logically separated, and development, test, staging and production environments are kept apart.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
Anthropic Claude (Sonnet and Opus) and OpenAI GPT models, hosted on AWS Bedrock, Google Vertex AI, Azure OpenAI and OpenAI depending on the customer's region. Availability varies by region
LLM retention settings
Legora’s customer terms prohibit sub-processors, other than cloud storage providers, from retaining Subscriber Content or logging it for human review. Model providers are contracted under zero-data-retention terms.
LLM data tenancy policy
Customer environments are logically separated. Legora does not use a customer's Confidential Information, including Subscriber Content, to train or fine-tune AI models, and does not allow its subcontractors to do so. Usage data Legora collects is limited
LLM data residency policy
Model processing takes place with the sub-processors and in the locations listed for the customer's region on our sub-processor page: EU/EEA for EU customers and the US for US customers. For Asia-Pacific and Australian customers, model processing may take
Certifications & compliance
SOC attestation
ISO/IEC-27001 certification
ISO/IEC-27017 attestation
Privacy Shield notice
GDPR commitment
Data deletion request procedure
Customers can request deletion of Subscriber Content at any time by written request to privacy@legora.com. At the customer's choice, Legora securely deletes or returns all personal data when the data processing agreement ends, and confirms in writing on request. After termination, Legora helps the customer retrieve its content for 30 days and then securely deletes all remaining Subscriber Content using industry-standard data destruction practices, unless applicable law requires retention. Where deletion is not possible, Legora blocks the data from further processing and requires its sub-processors to do the same. Requests from individuals are referred to the customer as data controller.
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Supports Single Sign On (SSO) with the following providers
SAML 2.0 and OpenID Connect single sign-on, with native support for Microsoft Entra ID, Okta and Google Workspace, plus ADFS, PingFederate and any other SAML 2.0 or OIDC-compliant provider. SCIM provisioning for Entra ID, Okta and generic SAML/OIDC links.
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
yes
Contact for security issues
security@legora.com
Has a vulnerability disclosure program
yes
Vulnerability disclosure program URL
Vulnerability disclosure program covers Slack app
yes
Has a bug bounty program
no
Requires third party authorization/connections
no
Uses token rotation
no