Security principles

Insimen Legal Service is designed around least-privilege access, protection by design, and limiting impact when an issue occurs. No digital system is risk-free, so controls are reviewed and improved as the product evolves.

Product controls

Controls are applied in proportion to the feature and its risk.

• authentication and role-based access controls for relevant areas
• server-side validation, sensitive-access restrictions, and audit logging for significant activity
• separation of secret configuration from public application code and secure session handling
• operational monitoring and phased security improvements

Your role

Keep your account and devices secure.

• Use a unique password and never share it.
• Enable available account verification methods.
• Do not send passwords, one-time codes, tokens, or other secrets through regular messages.
• keep your credentials and devices secure
• provide accurate information and ensure you have the right to upload documents
• not use the service for unlawful activity, fraud, or unauthorized access

Sensitive access and changes

Sensitive changes are checked server-side. Relevant activity may be recorded to support security, abuse prevention, and incident investigation.

Incident reporting

If you suspect unauthorized access, change your password, sign out of unrecognized sessions, and contact us. Do not include passwords, one-time codes, or unnecessary private content in a report.

Important limit

Insimen provides digital tools and service assistance; legal, tax, and business decisions should still be reviewed by the appropriately qualified party for your needs.

Shared security responsibilities

Insimen applies controls appropriate to context and risk, including authority checks, session protection, validation and restricted access to sensitive data. Controls are reviewed as services change; this description does not certify every integration or promise identical controls everywhere.

Use a unique password, device protection and available additional verification. Check domains, recipients and permission requests before sharing data. Support does not request passwords, PINs, one-time codes, private keys or recovery codes. Organisation owners should review members and remove obsolete access.

Reporting, evidence and recovery

Report suspected account takeover, unauthorised data access or transaction errors to cs@insimen.com with the service, incident time and a safe description. Do not exploit an issue, access others’ data, publish secrets or send unnecessary sensitive samples.

Insimen may verify ownership, restrict risky sessions or features and review relevant records. Recovery depends on findings and the incident; a report alone does not guarantee recovery of all data or funds. Actions remain subject to statutory duties and user rights.

Verifying instructions and submissions

Confirm through official channels that changes to recipients, bank details, signatories, or submission instructions come from an authorized person. Do not send blank signatures, one-time codes, passwords, or digital-identity access to someone claiming to be staff. Report suspected unauthorized document changes with the version and order reference.