Trust Center
Everything you need to evaluate LexCompliance in your procurement process.
Last updated: May 17, 2026
Operational status
Downloadable documents
CAIQ v4 CSA Consensus Assessments Initiative Questionnaire v4 — LexCompliance cloud security self-assessment. May 17, 2026 | Download PDF |
Privacy Policy | View → |
Security Policy | View → |
Data Processing Agreement (DPA) Available upon request at dpo@forensic.cl | Request |
Sub-processors
LexCompliance uses the following infrastructure sub-processors to deliver the service:
| Name | Role | Processing region | Privacy policy |
|---|---|---|---|
| Vercel Inc. | Hosting frontend, Edge Network, CDN, variables de entorno cifradas | EE.UU. / Global | Policy |
| Supabase Inc. | Base de datos PostgreSQL, Object Storage (adjuntos cifrados) y backups automáticos | EE.UU. / AWS sa-east-1 (Brasil) | Policy |
| Resend Inc. | Envío de emails transaccionales: notificaciones, acuses de recibo, onboarding | EE.UU. | Policy |
| Upstash Inc. | Cache Redis y rate limiting distribuido | EE.UU. / EU | Policy |
| Functional Software Inc. (Sentry) | Monitoreo de errores y alertas de incidentes | EE.UU. | Policy |
| Intuition Machines Inc. (hCaptcha) | CAPTCHA anti-bot en portal público de denuncias | EE.UU. | Policy |
| FLOW SpA | Procesamiento de pagos SaaS (suscripciones, facturación) | Chile | Policy |
| Better Stack Inc. | Monitoreo de disponibilidad (uptime), alertas de incidentes, status page público | EE.UU. | Policy |
Certifications & standards
Ley Karin (21.643)
Decreto 21/2024 — cobertura nativa completa
Implemented
Ley 21.719
DPIA, ROPA, ARCO+, DPAs
Implemented
Ley 20.393
Modelo de Prevención de Delitos
Implemented
GDPR Ready
DPAs disponibles bajo solicitud — transferencias EEE documentadas (art. 28 GDPR)
Implemented
ISO 27001:2022
Target Q4 2026
In progress
SOC 2 Type I
Target Q1 2027
In progress
Data retention
| Data type | Retention period | Legal basis |
|---|---|---|
| Denuncias activas | Duración del proceso + 5 años | Ley Karin / 20.393 |
| PII denunciante | Hasta cierre + 5 años (cifrado) | Decreto 21/2024 |
| Audit log | 5 años mínimo | Ley 21.719 |
| Logs de acceso | 12 meses | ISO 27001 |
| Backups cifrados | 90 días rolling | Política interna |
DPO contact
dpo@forensic.cl
dpo@forensic.clResponse time
72 business hours
In the event of a security breach, LexCompliance notifies affected data subjects and the National Data Protection Agency (ANDP) within 72 hours of discovering the breach, in accordance with Art. 49 of Law 21.719.