Securitywithout compromise.
Leading firms trust Crimson with privileged material on disputes worth billions. From its architecture to its interface, we design every component to minimize risk, protect confidentiality, and preserve privilege.
SOC 2 Type II
Independently attested, with no exceptions
Zero retention
No model training on client data, ever
Your region
UK, US, EEA, or Australia on Azure
Built for enterprise,
secure by design.
SOC 2 Type II attested
Independent auditors have verified Crimson's security, availability, and confidentiality controls over an extended period, with no exceptions.
GDPR and UK GDPR compliant
Crimson builds data minimization, purpose limitation, and lawful processing principles into how it handles personal data.
Strict data isolation
Each customer's data lives in its own logically and operationally isolated environment. We never pool or share data between firms.
No model training
We never use client data to train models for any third party. AI providers operate under zero data retention with no human review.
Flexible data residency
Choose your Microsoft Azure region for data storage: UK, US, EEA, or Australia. Your data does not leave it.
Encrypted single sign-on
Access via Microsoft Entra ID SSO with multi-factor authentication, role-based permissions, and AES-256 encryption at rest.
Engineered for
secure litigation.
We built Crimson from the ground up around the needs of disputes teams. The controls below are standard on every deployment, and our security team works directly with your information security function during onboarding.
End-to-end encryption
TLS 1.2+ for all data in transit and AES-256 for data at rest.
Zero data retention
Zero retention by AI providers, with an exemption from anti-abuse monitoring so that no human ever reviews your data.
Continuous monitoring
24/7 security monitoring with automated threat detection, logging, and real-time alerting.
Comprehensive audit logs
Full traceability and auditability of activity on every matter.
Independently verified,
fully documented.
Our security portal gives your information security team direct access to audit reports, policies, and control documentation.
Attested
SOC 2 Type II
Compliant
GDPR / UK GDPR
Annual
Penetration testing
Questions from information security and risk teams.
Further questions? Contact our team.
No. Crimson does not use client data to train models for any third party. All AI processing takes place in a secure environment within Microsoft Azure, and any output improvements are limited to each customer's own use.