Company & registrations
| Item | Status | Reference |
|---|---|---|
| Companies House | Registered, England & Wales | 16800372 |
| ICO controller registration | Live | Registered 14 May 2026 (reference ZC147676) — expires 13 May 2027, listed on the ICO public register |
| VAT registration | In progress (HMRC) | Number added on receipt |
| Director ID verification (ECCTA 2023) | In progress | Awaiting Companies House WebFiling auth code |
ICO registration number: ZC147676 — registered 14 May 2026, expires 13 May 2027. Data Protection Officer: dpo@lawfuze.com.
Data residency & hosting
- Primary cloud: Microsoft Azure UK South (London). AWS is not used.
- Secrets management: Azure Key Vault, environment-scoped service principals.
- Backups: automated, encrypted PostgreSQL backups with point-in-time restore for 14 days, copied to a second UK region; deleted files recoverable for 30 days.
- AI inference: Anthropic (Claude), processed in the US under the safeguards in our sub-processor register; search embeddings in Microsoft Azure UK South.
Certifications & controls
| Control | Status | Evidence |
|---|---|---|
| UK GDPR alignment | Live | Published Privacy Policy and sub-processor register; ROPA and LIAs in preparation |
| DPIA (Art 35 UK GDPR) | In progress | Risk matrix + mitigations; DPO sign-off before public launch |
| ROPA (Art 30 UK GDPR) | In progress | One row per processing activity, lawful basis recorded — before public launch |
| Append-only audit log | Live | DB-level triggers block UPDATE/DELETE; kept at least 6 years |
| Cyber Essentials Plus | In progress | IASME assessor booking by Phase 2 |
| PII / Cyber / D&O insurance | In progress | Broker enquiry with Hiscox / Markel / Beazley |
| CREST pen test | Planned (Phase 2) | Date to be confirmed before public launch |
| WCAG 2.2 AA conformance | Planned (Phase 2) | Audit + remediation before public launch |
| ISO 27001 | On roadmap | Targeted post-launch |
| SOC 2 Type II | On roadmap | Targeted post-launch |
Security contacts
- Data Protection Officer: dpo@lawfuze.com
- Security disclosures: security@lawfuze.com
- UK GDPR data subject requests: legal@lawfuze.com
- Breach reporting (24/7): security@lawfuze.com — we acknowledge within 4 hours, ICO notification within 72 hours where required.
Honest disclaimers
Certifications listed as in progress or on roadmap are not current attestations. We publish certificate references only once an accredited body has issued them. Early-access firms should treat the platform as pre-release until public launch.
UK regulatory and case-law context
LawFuze's posture is shaped by three live UK regulatory signals that every solicitor evaluating an AI tool should be aware of:
- Data (Use and Access) Act 2025, Section 80 — replaced the previous UK GDPR Article 22 framework on 5 February 2026, inserting Articles 22A–D. The live statutory phrase is "meaningful human involvement in significant decisions". LawFuze's supervisor-review queue is the implementation pathway for solicitors relying on AI outputs in client work. (legislation.gov.uk)
- Garfield AI — SRA authorisation, May 2025 — the SRA authorised the first wholly-AI legal services firm after an eight-month review focused on hallucination mitigation and human oversight. LawFuze tracks the same standards (refusal-first prompts, audit-logged supervisor sign-off, no unsupervised client communication). (sra.org.uk)
- Ayinde v Haringey London Borough Council [2025] EWHC 1383 (Admin) — the High Court made a wasted-costs order against legal representatives who relied on fabricated AI-generated case citations, with referrals to the SRA and the BSB. Cited here so firms understand the disciplinary reality of unverified AI output. LawFuze's citation-verification + refusal architecture is designed precisely so a supervising solicitor never finds themselves on the wrong side of an Ayinde-style order.
Bar Council guidance on generative AI for the bar was updated in November 2025 and is consistent with the SRA position.