Laserfiche Solutions for the Public Sector
Security Certifications and Compliance Frameworks
GovRAMP
Pending
Laserfiche will achieve GovRAMP Verified status, demonstrating its implementation of security controls aligned with GovRAMP and NIST SP 800-53.
CJIS Ready
Laserfiche Cloud supports CJIS-ready controls that help organizations securely manage Criminal Justice Information (CJI). Enterprise Security provides enhanced auditing, monitoring, encryption and administrative controls that address CJIS and other security requirements.
SOC 2 Type 2 Plus
This report details the controls for Laserfiche Cloud related to the criteria for the security, availability and confidentiality principles set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Criteria). To view a copy of this report, please .
ISO/IEC 27001:2022
Laserfiche has for its information security management system (ISMS) within the scope defined by its Statement of Applicability, covering its suite of SaaS and self-hosted enterprise content management and process automation applications.
HIPAA
Laserfiche’s SOC Type 2 Plus covers the security requirements set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), provided within Title 45 Code of Federal Regulations Sections 164.308 – 312 (45 CFR Sections 164.308-312) (the Security Requirements).
Web Content Accessibility Guidelines 2.2 AA
Laserfiche has published available for all Laserfiche Cloud and self-hosted products. Alignment to the WCAG 2.2 Level AA standard is the basis of our approach to compliance with Section 508 and EN 301 549 requirements.
DoD 5015.2
DoD 5015.2 details the Department of Defense’s baseline requirements for Records Management Applications (RMA), that facilitate adequate and appropriate basis for addressing the basic challenges of managing records in the automated environment that increasingly characterizes the creation and use of records. Laserfiche Cloud records management controls are based on our self-hosted Department of Defense 5015.2 version 3-certified electronic records management capabilities.
SEC Rule 17a-4
Laserfiche features support non-alterable record archival requirements such as WORM (write once, read many) used to address SEC Rule 17a-4 for broker dealers. Beyond financial services, Laserfiche’s controls can also be applied to support records management practices for electronically stored information (ESI) requiring prevention of any unauthorized alternations or deletions of digital records.
HECVAT
Laserfiche has completed the Higher Education Community Vendor Assessment Toolkit () questionnaire.
NIST 800-53
Laserfiche security controls are aligned with
AI Security and Governance
Laserfiche AI services are provided using AI models and services from OpenAI. For information on AI services in regions where OpenAI is not available, please
Regional data privacy requirements
Laserfiche AI addresses privacy and security standards of our current data center locations supporting GDPR (EU), CCPA/CPRA (USA), and PIPEDA (Canada) for low to moderate risk data. Our AI features are architected to support regional and industry-specific compliance needs, providing the same level of data sovereignty and protection you expect from Laserfiche Cloud.
For more information related to Laserfiche AI and data privacy, refer to the following:
- Laserfiche
- OpenAI
You own your data
- You retain ownership of inputs you provide. While Laserfiche owns the intellectual property rights to the outputs generated by our AI tools, we grant you a broad license to use those outputs for any of your organization’s internal business needs.
- Laserfiche does not use your organization’s data to train any internal or external AI models. Your data is used only as needed to deliver services and to meet our legal and regulatory obligations.
Laserfiche AI user prompts
Laserfiche designs its AI features with safety and security as core principles. We manage prompting risks through two layers of protection:
- Prompt-less by design: Many Laserfiche AI features, such as Document Summarization, do not use user prompts, reducing risks associated with accidental or malicious prompting.
- Enterprise-grade safeguards: For features that do accept user input, like Smart Fields and Smart Chat, we employ industry-standard protections against prompt injection. These include input filtering, validation, and other controls that keep prompts and responses within defined, limited boundaries.
Content confidentiality
Your confidential content is not accessible to other customers or unauthorized third parties. Laserfiche distinguishes between two types of data:
- Your confidential content: Laserfiche does not sell your data. Documents, files, and inputs you upload to Laserfiche are your own content.
- Usage and system data: Like most cloud providers, Laserfiche collects limited, high-level usage data (such as feature adoption and system performance metrics) to operate and improve the platform. This data is de-identified and does not include the contents of your documents or AI prompts.
Data retention
OpenAI may store the prompts you enter or the responses you receive temporarily for up to 30 days to provide services and identify abuse. After 30 days, API inputs and outputs are removed from their systems, unless they are legally required to retain them. For more details, please refer to the .
Below are some of the security controls Laserfiche software includes. If you have questions about a particular security solution or control, please directly.
Laserfiche Cloud supports single sign-on with Active Directory Federation Services (AD FS) and SAML authentication with identity providers such as Okta and Azure Active Directory.
The Laserfiche Cloud repository audit log includes details of user actions, including viewing, modifying, creating and deleting documents, and similar operations on metadata and other repository objects.
Administrators can use access rights to limit and control access to individual documents and objects. For example, security tags restrict access to documents on a document-by-document basis.
Laserfiche Cloud utilizes host-based intrusion detection systems to reduce the risk of data theft by individuals or organizations attempting to gain unauthorized access.
Administrators can configure access rights and privileges to limit actions that users can perform across the repository based upon role assignments or group memberships.
Laserfiche AI data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Laserfiche does not utilize any of your data to train internal or external AI models.
Laserfiche Cloud supports industry-standard password controls, such as password minimum length, complexity and history.
Laserfiche engages third-party vendors to conduct external penetration testing of the Laserfiche Cloud system.
Laserfiche performs a vulnerability scan of backend servers that run in the Laserfiche Cloud hosting environment.
Laserfiche Cloud’s firewall configuration settings are regularly reviewed based on industry standards.
Laserfiche Cloud supports auditing of both access and modification of objects in repositories.
Enterprise Security
Securely modernize your business-critical work with Laserfiche Cloud.
Laserfiche Enterprise Security enhances security, resilience and governance capabilities for organizations managing sensitive, highly regulated data in Laserfiche Cloud. It provides FIPS 140-3 encryption, privileged-user activity visibility, configurable session controls and multi-region disaster recovery with near real-time account-level replication.
Available to Laserfiche Cloud Business customers as an optional Add On, included with Business+ and offered for eligible Municipal Cloud packages.
Features
- Multi-region disaster recovery with near real-time repository replication
- Four-hour repository snapshots
- Enhanced user and privileged account monitoring
- Configurable security policies including inactivity session time out controls