Legify — Acceptable Use & Security Policy
Last updated:
1. Purpose
This policy sets out acceptable use requirements and the shared responsibilities relevant to the secure use of Legify.
Legify is provided by Neurobay Ltd and is intended to support professional legal and administrative workflows.
The platform may process confidential, sensitive or legally privileged information, and users must act accordingly.
This policy supplements the applicable Platform Terms of Service and customer agreement.
2. Authorised use
Legify may be used only by organisations and users authorised under the applicable customer agreement.
Users must:
- Access only records they are authorised to view.
- Use individually assigned accounts where required.
- Protect authentication credentials.
- Follow their organisation's confidentiality procedures.
- Verify recipients before sending correspondence.
- Upload information only where they have lawful authority.
- Report suspected security incidents promptly.
- Comply with applicable law and professional obligations.
3. Prohibited activities
Users must not:
- Attempt to access another customer's records or environment.
- Circumvent authentication or permission controls.
- Share access credentials inappropriately.
- Introduce malware or malicious content.
- Exploit security vulnerabilities.
- Interfere with service availability.
- Attempt unauthorised extraction of platform data.
- Process information for unlawful purposes.
- Misuse third-party integrations.
- Use the service in a manner that infringes applicable intellectual property or confidentiality rights.
Good-faith security research must be conducted only with appropriate authorisation.
To report a suspected vulnerability, email contact@legify.co.uk.
4. Confidential legal information
Customer organisations should ensure that users understand the sensitivity of legal case information.
Users should take particular care with:
- Legal professional privilege.
- Client communications.
- Identification documents.
- Medical evidence.
- Financial information.
- Information concerning children.
- Litigation and investigation records.
- Special-category or criminal offence data.
Users must not disclose confidential information to unauthorised persons or use it for purposes unrelated to their authorised duties.
5. User access and permissions
Customer administrators are responsible for maintaining appropriate access rights within their organisation.
Access should be granted according to operational need and withdrawn promptly when no longer appropriate.
Users must not assume that all employees within a law firm are entitled to access every matter.
Highly sensitive matters may require additional access restrictions.
Where the product supports specific confidentiality or restricted-matter controls, customers should configure and review them appropriately.
6. Document security
Users must ensure that documents are uploaded to the correct matters and shared only with authorised recipients.
Before sending documents by email or another external channel, users should verify:
- Recipient identity.
- Matter association.
- Attachment selection.
- Confidentiality restrictions.
- Applicable professional requirements.
The presence of a document in Legify does not itself authorise its disclosure.
7. Email and third-party integrations
Where the platform is connected to external email, storage, communications or other services, the customer must ensure the relevant accounts are authorised and appropriately secured.
External systems remain subject to their own security controls and contractual arrangements.
The Customer should review integration permissions and remove connections that are no longer required.
8. Security incidents
Suspected unauthorised access, data loss, credential compromise or other significant security issues should be reported without undue delay.
Security contact: contact@legify.co.uk
Reports should include relevant information, where available, without unnecessarily transmitting confidential records through insecure channels.
The parties' contractual incident responsibilities are set out in the applicable service agreement and Data Processing Agreement.
9. Backups and continuity
The Customer and Provider will perform the backup, recovery and maintenance responsibilities allocated in their agreement.
Customer organisations should maintain appropriate business continuity and contingency procedures for time-critical legal activities.
The platform must not be assumed to provide a guaranteed deadline-monitoring service unless expressly agreed.
10. Platform security information
Legify's applicable technical and organisational security arrangements are documented in its customer-facing security and contractual schedules.
Security arrangements depend on the hosting model, service configuration and agreed responsibilities.
Detailed information concerning infrastructure, backups, access controls and relevant assurance assessments may be made available to eligible customers under appropriate confidentiality arrangements.
We do not represent that Legify holds any particular security certification unless it has been formally obtained and verified.
11. Policy enforcement
Where reasonably necessary to protect security, comply with law or address material misuse, the Provider may investigate relevant activity and take proportionate corrective action.
Action may include access restriction or suspension in accordance with the Platform Terms of Service.
Measures will take account of legitimate access to Customer Data and the sensitivity of legal records.
12. Updates
This policy may be revised to reflect changes in the platform, security standards, applicable law or operating arrangements.
Material changes affecting contractual commitments will be handled according to the applicable customer agreement.
13. Contact
Neurobay Ltd — Legify
Registered office:
Suite 2458 Unit 5
399–405 Oxford Street
Mayfair, London W1C 2BU
United Kingdom
Security enquiries: contact@legify.co.uk
General enquiries: contact@legify.co.uk
Website: https://www.legify.co.uk