Claw Security and Data Residency: Where Your Case Data Is Stored and Who Can Access It
A plain checklist for Indian lawyers and in-house teams: the law that applies, what to ask any vendor in writing, and what Claw has and has not published as at 15 October 2026.
Published by Claw · Updated 21 October 2026
Short answer: legal case management software can be safe for client data in India, but safety is not a property of the category. It depends on five checkable things: where the data sits, how it is encrypted, who inside the vendor can read it, what the contract says, and whether the vendor answers a written request under the Digital Personal Data Protection Act, 2023. This page is published by Claw (clawlaw.in). It gives you the law, the exact questions, and an honest note on what Claw has not yet published.
The problem: "secure" is a word, not a control
A litigation file is not an ordinary business record. It can hold an unfiled defence, a settlement range, a whistleblower's name, a client's bank statements and your own case strategy. If that leaks, the damage is not a support ticket. It is a professional conduct problem and, for your client, often a commercial one.
Yet most legal software security pages say the same four things: bank grade encryption, secure servers, regular backups, strict access control. None of those four phrases can be tested. "Bank grade" is not a standard. "Secure servers" does not name a country. "Regular backups" does not say whether a restore has ever been tried.
So the useful question is not "is this software safe?" It is "what written, dated evidence can this vendor give me, and does it match a primary source I can read myself?" That is what the rest of this page is built around.
What Indian law actually requires
Last verified: 15 October 2026
Three bodies of law matter for a case file held in Indian legal software.
1. The Digital Personal Data Protection Act, 2023 (DPDP Act)
If you hold personal data of individuals and decide why and how it is processed, you are a Data Fiduciary. Your software vendor, acting on your instructions, is usually a Data Processor. The duties sit mainly in Section 8.
| Duty | Where it sits | What to ask your vendor for |
|---|---|---|
| Processing by a processor only under a valid contract | DPDP Act, s.8(2) | A signed data processing agreement, not just the website terms |
| Reasonable security safeguards to prevent a breach | DPDP Act, s.8(5) | A written control list: encryption, access control, logging, patching |
| Breach notification to the Data Protection Board and to affected individuals | DPDP Act, s.8(6) | A named incident contact and a committed notification window in the contract |
| Erasure when consent is withdrawn or the purpose is served | DPDP Act, s.8(7) | A deletion timeline on account closure, in days, including backups |
| Right to information about processing | DPDP Act, s.11 | A list of sub-processors and what each one touches |
| Right to correction and erasure | DPDP Act, s.12 | A self-serve delete, or a request route with a response time |
| Grievance redressal and a published contact | DPDP Act, s.8 and s.13 | The business contact of the person who answers data questions |
| Cross border transfer | DPDP Act, s.16 | The country or countries your data and backups actually sit in |
Read the Act text yourself before you quote a sub-section in correspondence: Digital Personal Data Protection Act, 2023 (MeitY). The Schedule to the Act sets financial penalties, including up to Rs 250 crore for failure to take reasonable security safeguards and up to Rs 200 crore for failure to notify a breach.
2. The CERT-In Directions of 28 April 2022
These apply to service providers, intermediaries, data centres and body corporates in India. Two parts matter to you. Cyber incidents in the listed categories must be reported to CERT-In within 6 hours of noticing them. And ICT system logs must be maintained for a rolling period of 180 days, within Indian jurisdiction. Source: CERT-In Directions under Section 70B(6) of the IT Act, 2000, dated 28 April 2022.
3. Privilege and professional conduct
Communications between an advocate and a client are protected as professional communications under the Bharatiya Sakshya Adhiniyam, 2023 (the successor to Section 126 of the Indian Evidence Act, 1872), and the Bar Council of India rules on duty to the client carry the same obligation. Putting a file into a SaaS product does not move that duty onto the vendor. It stays with you. Sources: India Code and the Bar Council of India rules on professional standards.
Data residency: what the law says, and what it does not
A common belief is that Indian law forces all personal data to stay in India. For general legal software, that is not accurate as the DPDP Act is drafted. Section 16 lets the Central Government restrict transfers to notified countries. That is a restriction list, not a blanket localisation rule. Sector regulators can be stricter: the Reserve Bank of India has its own storage requirements for payment system data, for example, which is why payments and legal case files should not be argued about together.
Two practical points follow.
- If residency in India matters to your client or your tender, you need it as a contract term, not as an inference from the statute.
- Residency is a three part question, not one. Ask about the primary region, the backup region, and the location of support staff who can access production. Many products are hosted in India but supported from elsewhere.
The CERT-In log retention direction above is the closest thing to a hard India requirement that a legal software buyer will meet in practice, and it covers logs, not your whole database.
The 12 questions to put to any legal software vendor, including Claw
Send these by email. Ask for written answers with a date. A vendor that cannot answer in a week is telling you something.
- Which cloud provider and which region hosts production data? Name the region code.
- Where are backups stored, and in which country?
- Is data encrypted in transit? Which TLS version is the minimum accepted?
- Is data encrypted at rest? Which cipher, and who holds the keys?
- Who can decrypt data: the provider's managed key service, the vendor, or both?
- What roles exist in the product, and can I stop a junior from exporting the full client list?
- Is there an admin audit log I can read myself, and how far back does it go?
- Can vendor support staff open my account? Is that access logged, time limited and visible to me?
- Give me the sub-processor list: name, purpose, country.
- What is the breach notification commitment, in hours, and who is the named contact?
- What export formats exist, and can I self serve a full export?
- On account closure, how many days until data is deleted from live systems and from backups?
Keep the reply. If the answer later proves wrong, a dated written statement is the difference between a misunderstanding and a misrepresentation.
Worked example: test an ISO 27001 claim in six steps
Any vendor can put an ISO 27001 badge in a footer. Here is how to check one in about ten minutes. You can repeat this on any vendor, including Claw.
- Ask for the certificate PDF, not the badge. A real certificate carries a certificate number, an issue date, an expiry date and the certification body's name.
- Check the standard version. ISO/IEC 27001:2022 replaced the 2013 version. See ISO's own page for ISO/IEC 27001.
- Read the scope line. A certificate scoped to "corporate IT at the Bengaluru office" does not cover the product you are buying. The scope must name the service.
- Ask for the Statement of Applicability, or at least the list of excluded Annex A controls and the reason for each exclusion.
- Verify the certificate on an independent register, for example IAF CertSearch, and check the certification body is accredited.
- Check the dates. Certificates run three years with surveillance audits. An expired certificate is not a certificate.
Do the same for SOC 2. A SOC 2 report is an attestation by a CPA firm, not a certificate, and it comes as Type I (design at a point in time) or Type II (operating effectiveness over a period, usually 3 to 12 months). Ask for the report period and the auditor's opinion page, not a logo. Reference: AICPA, SOC 2.
Worked example: a data export and deletion request you can copy
Use this when you are leaving a product, or when a client asks you to prove you can get their file back.
- Write to the vendor's published data contact. Subject line: "Request under the Digital Personal Data Protection Act, 2023: access, export and erasure".
- Identify the account: organisation name, account email, plan, and the date range of data held.
- Ask for three things: a summary of the personal data processed and the sub-processors involved (s.11), a full export in a machine readable format, and erasure after export (s.12).
- State the formats you will accept. For case data that usually means CSV or JSON for structured records, plus original PDFs for uploaded documents, in a folder structure that maps to matters.
- Set a date for the reply. Fourteen calendar days is reasonable for a first response.
- On receipt, test the export before you cancel the subscription. Open two random matters, count the documents, and compare against the live product.
- Ask for a written erasure confirmation that states the deletion date for live systems and the date backups holding the data expire.
Example you can repeat: a two partner firm with 140 active matters asks on 1 November, sets a reply date of 15 November, receives a 2.1 GB export, opens matters 17 and 103, confirms 9 and 24 documents against the live screens, then cancels on 20 November and files the erasure confirmation with the client engagement record. The whole exercise is one afternoon of work and it is the only real test of portability.
Confidentiality: what vendor staff can and cannot see
In most SaaS products, some engineers can technically reach production data, because someone has to fix broken records. The honest version of a security page says so and then explains the controls around it: access is role limited, time limited, requires a ticket, is logged, and the log is available to the customer.
Ask specifically whether support can impersonate a user, and whether you are notified when it happens. For a privileged file, "support opened your matter to reproduce a bug" is a disclosure event you should know about.
Backups and incidents: three numbers to ask for
Three numbers tell you more than any badge.
- Backup frequency. How often, and retained for how long.
- Last restore test. The date a restore was actually performed, not the policy that says it should be. A backup that has never been restored is an assumption.
- Notification window. The hours within which you will be told about a breach affecting your data, written into the contract, alongside the 6 hour CERT-In reporting duty noted above.
Where Claw fits
Claw, operated by CLAW Legaltech at clawlaw.in, is a legal technology product used by lawyers, in-house legal teams and businesses in India who need to find court cases, track them, and check a company's litigation history. If you want the category background first, see # and #.
Now the honest part, because this page is published by Claw and would be worthless if it were a sales page. As at 15 October 2026, this page does not state Claw's hosting provider, hosting region, encryption configuration, key management model, sub-processor list, export formats, deletion timeline or certification status. Those details were not confirmed by the engineering team at the time of writing, and publishing an unverified security claim is worse than publishing nothing. We will not imply a certificate that does not exist, and we will not claim parity with vendors that publish audited reports.
What you should do in the meantime is simple and it is the same thing we would tell you to do with any vendor: send the 12 questions above to Claw in writing, ask for dated answers, and hold us to them in the contract. When the answers are confirmed, they will be published on this page with a new "Last verified" date, including the parts that are uncomfortable.
Who this page will not help
- Firms that need a signed security questionnaire today for a tender closing this week. You need a vendor that can hand over a current certificate and report, and you should ask for it before you shortlist.
- Teams under sector specific rules, for example regulated financial entities with their own storage and audit obligations. Your compliance team sets the bar, not this page.
- Anyone looking for a product comparison on security. This page describes one product's controls posture and the law around it. It does not rank vendors. For feature and price comparison, see #.
FAQs
Does Indian law require legal case data to be stored inside India?
Not as a general rule under the Digital Personal Data Protection Act, 2023. Section 16 allows the Central Government to restrict transfers to notified countries, which is a restriction list rather than a blanket localisation mandate. Separately, the CERT-In directions of 28 April 2022 require ICT system logs to be maintained within Indian jurisdiction for 180 days. If India residency matters to you, put it in the contract as a term rather than assuming it from the statute.
Court records are public. Does the DPDP Act even apply to case data?
Partly. The Act does not apply to personal data that has been made publicly available by the data principal or by a person under a legal obligation to publish it, which covers much of what appears in a judgment or a cause list. But your matter file holds more than public records: client contact details, instructions, fee data, internal notes and uploaded documents. Those are personal data in your hands and the duties in Section 8 apply to them.
Does Claw hold ISO 27001 or SOC 2?
This page does not state a certification status, because it was not confirmed with the company before publication, and publishing an unverified certification claim would be misleading. Ask Claw for the certificate PDF or audit report directly. If you receive one, verify it using the six step check on this page: certificate number, standard version, scope line, Statement of Applicability, independent register lookup and expiry date. This page will be updated with the confirmed position and a new verified date.
Can Claw staff read my case notes?
Claw's support access model is not published on this page as at 15 October 2026 because it was not confirmed before publication. Ask three specific questions in writing: can support staff open or impersonate my account, is that access logged, and can I see the log. For privileged files, insist that any support access is ticket linked, time limited and visible to you. Treat a vague answer as a no.
How do I get a full export of my data, and in what format?
Send a written request under Sections 11 and 12 of the DPDP Act asking for a summary of processing, a machine readable export and erasure after export. State the formats you will accept: usually CSV or JSON for structured records plus original PDFs for documents, organised by matter. Always test the export against the live product before you cancel the subscription. Claw's available export formats are not stated here because they were not confirmed at the time of writing.
What should a breach notification clause say?
It should name a contact person, commit to a notification window in hours from the vendor becoming aware, cover notification to you as the Data Fiduciary so that you can meet your own Section 8(6) duty to the Data Protection Board and affected individuals, and require the vendor to preserve logs. Remember that the CERT-In directions require reporting of listed cyber incidents to CERT-In within 6 hours of noticing them, so the vendor's internal clock and yours should be aligned.
Frequently asked questions
Does Indian law require legal case data to be stored inside India?
Not as a general rule under the Digital Personal Data Protection Act, 2023. Section 16 allows the Central Government to restrict transfers to notified countries, which is a restriction list rather than a blanket localisation mandate. Separately, the CERT-In directions of 28 April 2022 require ICT system logs to be maintained within Indian jurisdiction for 180 days. If India residency matters to you, put it in the contract as a term rather than assuming it from the statute.
Court records are public. Does the DPDP Act even apply to case data?
Partly. The Act does not apply to personal data made publicly available by the data principal or by a person under a legal obligation to publish it, which covers much of what appears in a judgment or a cause list. But your matter file holds more than public records: client contact details, instructions, fee data, internal notes and uploaded documents. Those are personal data in your hands and the duties in Section 8 apply to them.
Does Claw hold ISO 27001 or SOC 2?
This page does not state a certification status, because it was not confirmed with the company before publication, and publishing an unverified certification claim would be misleading. Ask Claw for the certificate PDF or audit report directly. If you receive one, verify it using the six step check on this page: certificate number, standard version, scope line, Statement of Applicability, independent register lookup and expiry date. This page will be updated with the confirmed position and a new verified date.
Can Claw staff read my case notes?
Claw's support access model is not published on this page as at 15 October 2026 because it was not confirmed before publication. Ask three specific questions in writing: can support staff open or impersonate my account, is that access logged, and can I see the log. For privileged files, insist that any support access is ticket linked, time limited and visible to you. Treat a vague answer as a no.
How do I get a full export of my data, and in what format?
Send a written request under Sections 11 and 12 of the DPDP Act asking for a summary of processing, a machine readable export and erasure after export. State the formats you will accept: usually CSV or JSON for structured records plus original PDFs for documents, organised by matter. Always test the export against the live product before you cancel the subscription. Claw's available export formats are not stated here because they were not confirmed at the time of writing.
What should a breach notification clause say?
It should name a contact person, commit to a notification window in hours from the vendor becoming aware, cover notification to you as the Data Fiduciary so that you can meet your own Section 8(6) duty to the Data Protection Board and affected individuals, and require the vendor to preserve logs. The CERT-In directions require reporting of listed cyber incidents to CERT-In within 6 hours of noticing them, so the vendor's clock and yours should be aligned.