Enterprise security
Enterprise-grade security for privileged pricing data.
Rates, OCGs, realization, and negotiation history are among the most sensitive assets in a firm. Lysp is built so that information stays yours - encrypted, isolated, auditable, and never used to train models.
Encryption
AES-256 · TLS 1.2+
Training
Never on your data
Residency
US · EU/CH · AU
Assurance
SOC 2 · ISO suite
Architecture
How privileged pricing data moves - and where it stops.
Firm systems remain the source of truth. Lysp isolates each workspace, encrypts every layer, and never feeds your corpus into shared model training.
01
Your systems
Matter history, rate cards, OCGs, PMS, and ethical walls stay under firm control.
02
Lysp workspace
Logically isolated tenant with encryption, RBAC, and full audit logging.
03
Model providers
Zero retention, no training. Used only to process your pricing requests.
04
Assurance
SOC 2, ISO, continuous monitoring, and third-party penetration tests.
Workspace isolation
Each firm’s rates, OCGs, and negotiations live in a logically separated tenant.
Matter history
Encrypted · RBAC · Audited
Rate cards
Encrypted · RBAC · Audited
Negotiation log
Encrypted · RBAC · Audited
Ethical walls
Your walls provider stays system of record.
Lysp syncs and enforces existing ethical wall policies. Restricted users cannot see or share walled pricing content. We never create, modify, or delete walls.
- Sync from your walls system of record
- Enforce on pricing artifacts and portals
- No Lysp-side wall inventing or edits
Controls
Security domains counsel and infosec review first.
Detail
Encryption & transport
Privileged commercial data protected in motion and at rest.
- AES-256 encryption at rest for firm workspaces
- TLS 1.2+ for all client and service traffic
- Key management with least-privilege access
- Encrypted backups with retention you control
Data residency
Process where your firm requires.
Localization extends to applicable subprocessors so residency commitments hold across the stack - not only the application tier.
Region
US
United States
Primary enterprise cloud region for North American firms and US-localized workloads.
Region
EU / CH
Europe & Switzerland
In-region processing for firms with European residency and transfer requirements.
Region
AU
Australia
Localized processing for APAC firms that require Australian data residency.
Certifications & frameworks
Independently attested assurances
External frameworks for security, privacy, and responsible AI - with links to the official standards bodies.
Framework
SOC 2 Type II
Annual independent audit of security, availability, and confidentiality controls across the Lysp platform and operations.
Official site ↗
Framework
CCPA
California privacy commitments for applicable personal information processed through Lysp on behalf of the firm.
Official site ↗
Framework
ISO 27001
Information security management system covering risk assessment, access control, cryptography, and continuous improvement.
Official site ↗
Framework
GDPR
European data-protection obligations: lawful processing, data subject rights, subprocessors, and transfer safeguards.
Official site ↗
Framework
ISO 27701
Privacy extension to ISO 27001 - how we govern personal data processing for firm users and client-facing workflows.
Official site ↗
Framework
ISO 42001
AI management system controls for responsible development, deployment, and oversight of AI used in pricing workflows.
Official site ↗
Enterprise-grade protection
Controls at every layer - from auth to model providers
- 01
Purpose-built controls
In-house security across infrastructure, product, and operations. Continuous monitoring, SAML SSO, audit logs, IP allow-listing, and full data lifecycle management.
- 02
Data sovereignty
You decide what enters Lysp, how long it stays, and when it is deleted. Keep processing in-region - US, EU / Switzerland, or Australia - including subprocessors where localization applies.
- 03
No model training
Contractually guaranteed: inputs, outputs, rate cards, OCGs, and uploaded matter files are never used to train underlying models. Providers operate under zero data retention for your workloads.
- 04
Ethical walls
Lysp syncs and enforces your firm’s existing ethical wall policies. Restricted users cannot see or share walled pricing content. We never create, modify, or delete walls - your walls provider stays system of record.
- 05
Enforceable commitments
Our Security Addendum binds data protection, access rules, and incident-response SLAs to SOC 2, ISO, GDPR, and related standards - auditable terms built to exceed generic vendor language.
- 06
Independently tested
Annual SOC 2 Type II and ISO audits, automated vulnerability scanning, third-party penetration tests, and continuous monitoring. External validation - not self-attestation alone.
Disclosures
Answers counsel and infosec ask first.
Encryption, residency, access, training bans, and audit cadence - in plain language.
Customer data includes documents and structured firm records you upload or sync into Lysp - matter history, invoices, rate sheets, OCGs, and related pricing artifacts. Customer content means prompts, pricing requests, and model responses generated in the product. We protect both under the same encryption, access, and no-training commitments.
All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Access follows least privilege with role-based controls. Each firm’s workspace is logically separated so data never commingles. Security obligations are passed through to subprocessors and model providers.
Lysp runs on enterprise cloud infrastructure. Firms with localization requirements can process in the US, EU / Switzerland, or Australia. The same regional posture extends to applicable subprocessors.
Strict RBAC and workspace separation ensure only authorized roles - pricing, partners, finance, and others you configure - can see specific data. You control what is ingested, retention windows, and whether content is shared inside the firm or via client portals.
No, by default. Lysp contractually prohibits providers from training on your data and requires zero data retention. Your data is used only to process your requests. If you explicitly request a bespoke model trained only on your firm’s corpus, that model is exclusive to you and never used for other customers.
We run continuous security monitoring, automated vulnerability scans, and annual third-party penetration tests, alongside yearly SOC 2 Type II and ISO program audits.
Security pack
Get the questionnaire answers, architecture overview, and cert evidence.
For procurement, infosec, and risk - packaged for enterprise review.