Nationwide Legal

01 Our Commitment

Nationwide Legal is committed to protecting the security, confidentiality, and integrity of information entrusted to us by our clients. We implement commercially reasonable and industry-accepted security practices designed to safeguard data against unauthorized access, disclosure, alteration, or loss.

02 Security Practices

We maintain a defense-in-depth security posture across our applications, infrastructure, and operations. Our controls are designed to reduce risk and support the confidentiality, integrity, and availability of customer data.

03 Data Protection

Data transmissions are encrypted using industry-accepted protocols such as Transport Layer Security (TLS).
Sensitive data is protected in transit and at rest where appropriate, using encryption and other protective measures.
Access to data is governed by the principle of least privilege.
We follow data minimization practices and limit data collection, processing, and retention to what is reasonably necessary to provide services.

04 Access Controls

Access to systems and data is limited to authorized personnel based on role and responsibility.
Authentication and access control mechanisms are implemented to protect systems and data.
Administrative access is subject to enhanced security controls.
User sessions are managed using security controls appropriate to the risk profile of the system.

05 Infrastructure Security

Our services are hosted with reputable cloud infrastructure providers that maintain recognized security standards.
Network-level controls are used to protect against unauthorized access and misuse.
Systems are monitored for security events, anomalies, and operational reliability.
Encrypted backups and recovery mechanisms are maintained to support data availability and business continuity.

06 Application Security

Applications are developed using secure coding practices appropriate to their function and risk profile.
Controls are implemented to address common classes of web application vulnerabilities, such as access control issues and abuse prevention.
Security considerations are integrated into the software development lifecycle.
Updates and patches are applied as reasonably necessary to address identified security issues.

07 Vendor Management

Third-party service providers are evaluated based on the nature of the services they provide and the data they may access.
Vendors that handle sensitive data are required to maintain appropriate contractual security and confidentiality obligations.
Nationwide Legal maintains reasonable oversight of vendor security practices consistent with risk and operational requirements.

08 Vulnerability Reporting

If you believe you have identified a potential security vulnerability affecting Nationwide Legal systems, please report it responsibly by contacting: security@nationwidelegal.com

Please include, where possible:

A description of the issue
Steps to reproduce the issue (if applicable)
Contact information for follow-up

Responsible Disclosure

Please do not include sensitive personal data in vulnerability reports beyond what is necessary to describe the issue. Nationwide Legal appreciates responsible disclosure and will acknowledge reports in a timely manner.

09 Vulnerability and Patch Management

Nationwide Legal maintains a vulnerability management process designed to identify, assess, prioritize, and remediate security issues. Remediation prioritization considers factors such as severity, exploitability, and exposure.

Target response timeframes include:

Acknowledgement

We aim to acknowledge reported vulnerabilities within two (2) business days.

Remediation Targets

These timeframes are targets and may vary based on complexity, operational constraints, or third-party dependencies.

High severity: targeted remediation within approximately seven (7) days
Medium severity: targeted remediation within approximately thirty (30) days
Low severity: targeted remediation within approximately ninety (90) days

10 Incident Response

Nationwide Legal maintains incident response procedures designed to detect, investigate, contain, and remediate security incidents.

In the event of a confirmed security incident affecting customer data:

We investigate and contain the incident as promptly as reasonably practicable.
Notifications are provided to affected parties as required by applicable law and contractual obligations.
Reasonable steps are taken to mitigate impact and reduce the likelihood of recurrence.

Target Response Activities

Initial triage: Initiated promptly upon detection or confirmation of a potential incident.
External reports: Reports submitted to security@nationwidelegal.com are typically acknowledged within two (2) business days.
Notifications: Provided without undue delay where legally required.

11 Business Continuity

Nationwide Legal maintains backup and recovery capabilities designed to support service resiliency and restore critical functions following system failures or operational disruptions.

12 Compliance

Our security program is designed to support compliance with applicable laws and data protection requirements. Security practices are periodically reviewed and updated to address evolving risks, operational changes, and regulatory considerations.

Security Policy