PointOne Security

Industry-leading security

Designed from the ground up to meet the security needs of the world's largest firms.

Visit the Trust Center

Compare using AIOpens ChatGPT in a new tab.
Dark green marble wall with a brass inlay line and a band of sunlight
SOC 2Type 2
ISO27001
GDPREU
HIPAAUS
Dark green marble wall with a brass inlay line and a band of sunlight
SOC 2Type 2
ISO27001
GDPREU
HIPAAUS

“The fact that PointOne could integrate with our existing systems while meeting our security requirements showed us, they had the flexibility to deliver what we needed in a secure manner.”

Johnathan Brock

IT Director, Irwin Fritchie

Certified and compliant

Our security controls are independently audited, so your firm's data and your clients' information stay protected at every layer.

SOC 2 Type 2

SOC 2 Type 2 certified our security controls are independently audited to ensure your firm's data is handled with the highest standards of confidentiality and integrity.

AICPA

ISO 27001

PointOne is fully certified with ISO 27001, the internationally recognized standard for information security management, so your data stays protected at every layer.

ISO 27001

GDPR

PointOne is built with data privacy by design, fully compliant with GDPR to ensure your firm and your clients' information is handled with transparency and care.

GDPR

HIPAA

For firms operating in healthcare-adjacent practices, PointOne meets HIPAA requirements, so sensitive patient and client data stays secure and compliant.

hipaa certification

SOC 2 Type 2

SOC 2 Type 2 certified our security controls are independently audited to ensure your firm's data is handled with the highest standards of confidentiality and integrity.

AICPA

ISO 27001

PointOne is fully certified with ISO 27001, the internationally recognized standard for information security management, so your data stays protected at every layer.

ISO 27001

GDPR

PointOne is built with data privacy by design, fully compliant with GDPR to ensure your firm and your clients' information is handled with transparency and care.

GDPR

HIPAA

For firms operating in healthcare-adjacent practices, PointOne meets HIPAA requirements, so sensitive patient and client data stays secure and compliant.

hipaa certification

SOC 2 Type 2

SOC 2 Type 2 certified our security controls are independently audited to ensure your firm's data is handled with the highest standards of confidentiality and integrity.

AICPA

ISO 27001

PointOne is fully certified with ISO 27001, the internationally recognized standard for information security management, so your data stays protected at every layer.

ISO 27001

GDPR

PointOne is built with data privacy by design, fully compliant with GDPR to ensure your firm and your clients' information is handled with transparency and care.

GDPR

HIPAA

For firms operating in healthcare-adjacent practices, PointOne meets HIPAA requirements, so sensitive patient and client data stays secure and compliant.

hipaa certification

Flexible deployment options

Fully configurable deployments that meet the stringent security needs of large law firms.

Full data segregation

Customizable data retention

Single-tenant options for enterprise deployments

Customizable geolocation

Works with on-prem systems

Responsible use of AI

AI systems carefully designed to eliminate data leakage and other security risks.

Zero training on firm data

Zero data retention by AI models

Customizable base models

Ability to use models within private Azure cloud

Auditability of AI outputs

A brushed steel box, leather folders and a brass key on a chain on a grey marble plinth

Read more about security

Is AI timekeeping secure? Our guide covers the six questions to ask any vendor, which certifications matter, and how to protect client data.

Read the guide

Frequently asked questions

No. Your firm's data is never used to train AI models, by PointOne or by any of our providers. That's both a contractual commitment and a technical one. All AI processing runs under enterprise zero-data-retention agreements. Data is processed transiently, then discarded. It isn't stored or logged by the model provider.

Yes. PointOne runs on AWS or Microsoft Azure. Every AI call is routed through a single controlled gateway, and every action is logged and attributed. Nothing is finalized without review: each time entry is a draft the timekeeper confirms. Administrators can also turn AI features off for the whole firm.

Yes. By default, data is hosted in the U.S. (AWS US-East), with redundancy across multiple data centers. Firms can choose to keep data in the EU, Canada or Australia. For firms with timekeepers in several countries, each timekeeper's data can stay in the jurisdiction where they work. Each firm's data is isolated at the database and compute level. Enterprise firms can choose a single-tenant deployment.

PointOne's data retention period is set by each firm. Firms can choose a longer or shorter period, including zero data retention.

Yes. Your firm sets separate retention periods for activity data, finalized time entries and audit logs. Activity data can be set to zero retention, so it's processed and deleted within seconds. Screen images are never stored, and administrators can't view them. Deletions are logged, so your team can confirm them. When a contract ends, customer data is purged within 90 days.

PointOne is SOC 2 Type 2 audited, ISO 27001 certified, GDPR compliant and HIPAA ready, built to pass the security reviews of AmLaw 100 firms and state governments.

Start at our Trust Center, trust.pointone.com, which lists our certifications, policies and subprocessors. PointOne holds SOC 2 Type I and Type II, ISO 27001, and is GDPR and HIPAA compliant. Data is encrypted at rest with AES-256 and in transit with TLS 1.2+. SOC 2 reports, penetration test summaries and our full security documentation are available under NDA. Contact your PointOne representative to request them.

Your firm’s most valuable asset is its data. It’s time to put it to work.

Talk to our teamBook a Demo

Your firm’s most valuable asset is its data. It’s time to put it to work.

Talk to our teamBook a Demo

Your firm’s most valuable asset is its data. It’s time to put it to work.

Talk to our teamBook a Demo