NewsTwala is now a Supreme Court–accredited Electronic Notarization Facility.Read the news
Book a demo (opens in a new tab)
Security

Enterprise-grade security, by default

Twala is built on industry-standard information security and data privacy policies: PKI and blockchain-powered document security, encryption in transit and of sensitive data, workspace access control, and AI that runs on Amazon Bedrock under Twala’s own AWS account, on resilient, high-availability infrastructure.

Book a demo (opens in a new tab)Visit the trust center

A document uploaded to a Twala workspace travels over HTTPS through CloudFront and Twala’s load balancer to the API, which runs in private subnets of Twala’s AWS account in the Asia Pacific (Singapore) region. The file is stored in Amazon S3; for files with AI search turned on, Cohere Embed v4 on Amazon Bedrock embeds it and OpenSearch Serverless indexes it, in a shared index filtered by workspace or the team’s own index; Claude on Amazon Bedrock answers from the files you can open. Outbound calls go through a NAT gateway, Bedrock uses global cross-region inference, and Lex’s optional web search uses Tavily. No user data is ever used to train the AI.

Private AI

AI that works for you, never trained on your data

Lex reads your documents on Amazon Bedrock, under Twala’s own AWS account, and no user data is ever used to train the AI.

Your files and their search indexes are kept in AWS Asia Pacific (Singapore). Bedrock requests enter in the same region and are served through Amazon’s global cross-region inference. Lex reads only the files you turned AI search on for and can open, and it reaches the public web only when it uses its optional web search.

  • Lex runs on Amazon Bedrock, Claude for answers and Cohere Embed v4 for embeddings, under Twala’s own AWS account01
  • Files and their search indexes are kept in AWS Asia Pacific (Singapore): Amazon S3 and OpenSearch Serverless02
  • AI search is opt-in for each file, and Lex answers only from files you can open03
  • No user data is ever used to train the AI04
HashOrigin Technology™

How we protect your document

Twala protects every signed document with HashOrigin™, a two-layer cryptographic security system combining PKI digital sealing with blockchain anchoring. Tamper with the lease below to see both layers respond.

A sealed Contract of Lease and its two HashOrigin layers: the digital signatures inside the PDF, with Twala’s Platform Seal applied last, and the sealed file’s hash, batched into a Merkle tree whose root is anchored on Polygon.

Both layers hold: the signatures match the content, and the recomputed root is the one anchored on Polygon.

1

PDF level: digital signatures and seal

When a document is sealed, Twala converts it to PDF/A-2b and applies the Twala Platform Seal: a digital signature over a SHA-256 digest of the finished PDF, made with Twala’s private key and verified with Twala’s X.509 certificate, issued by Twala’s private certificate authority. A verified organization’s seal is added first when the team has one. The signatures are timestamped by an RFC 3161 timestamp authority and, when every signature has it, carry embedded revocation evidence for long-term validation. Any change to the file is detected.

2

Blockchain level: anchoring on Polygon

Twala then records the sealed file’s SHA-256 hash. Every 15 minutes, the hashes recorded since the last run, up to 256, become a Merkle tree, and its root is written to Twala’s contract on the Polygon blockchain: a permanent, independent record outside Twala’s own systems that anyone can check.

Together, these layers make every Twala document tamper-evident, independently verifiable, ideal for long-term archiving, and legally defensible and court-admissible.

  • Public Key Infrastructure
  • X.509
  • SHA-256
  • keccak256
  • RFC 3161 timestamps
  • PDF/A-2b
  • Blockchain anchoring on Polygon
How HashOrigin worksVerify a document (opens in a new tab)
How we protect your data

Six security controls built into every layer of the platform

Encryption in transit and of sensitive fields

HTTPS on every connection, and sensitive fields such as bank details encrypted by the application before they are stored.

Workspace access control

Personal workspaces stay yours. On a team, members see only what is shared with them, and Lex follows the same rule.

SSO and passwordless sign-in

Google, Microsoft, your organization’s single sign-on, or a one-time email code, with optional two-factor authentication.

Role-based access control (RBAC)

Team owners and admins manage members, roles, and access, checked on every request.

Rate limiting and abuse prevention

Per-route rate limits, and a request ID on every request for traceability.

User-controlled document indexing

Turn on Enable AI search per file. A file uploaded with it off is stored, and Lex cannot answer from it.

Architecture

Infrastructure and architecture

Amazon Web Services in Asia Pacific (Singapore), with the API and workers in private subnets and AI on Amazon Bedrock.

01

Cloud infrastructure on AWS

  • API and workers run as ECS tasks in private subnets, in ap-southeast-1
  • HTTPS through Amazon CloudFront and an application load balancer
  • Files in Amazon S3, reached with IAM task roles, never hardcoded keys
  • PostgreSQL on Amazon RDS, with Redis caching and RabbitMQ job queues
02

AI on Amazon Bedrock

  • Claude for answers and Cohere Embed v4 for embeddings, both on Amazon Bedrock
  • Bedrock requests enter in ap-southeast-1 and are served through global cross-region inference
  • Vectors in OpenSearch Serverless: a shared index filtered by workspace, or one index per business-tier team
  • Lex’s optional web search uses Tavily, and no user data is ever used to train the AI
03

Observability and audit

  • Structured JSON logging with a request ID on every request
  • Response timing headers for latency monitoring
  • Audit log with HMAC-SHA256 integrity checks
  • Document version history and annotation snapshots
04

Resilient architecture

  • Database on Amazon RDS Multi-AZ, with a standby in a second availability zone
  • Modular services that scale independently under load
  • Failed background jobs, such as blockchain anchoring, are retried automatically
  • Background processing keeps the platform responsive under heavy load
Security checklist

Security measures, built into the platform

Security isn’t a premium feature at Twala.

  1. 01Lex runs on Amazon Bedrock under Twala’s own AWS accountActive
  2. 02No user data is ever used to train the AIActive
  3. 03AI search opt-in per file, with answers only from files you can openActive
  4. 04HTTPS on every connectionActive
  5. 05Sensitive fields encrypted by the application before storageActive
  6. 06Opaque httpOnly session cookie with SameSite protectionActive
  7. 07Short-lived access tokens, refreshed on the serverActive
  8. 08SHA-256 hashed refresh token storageActive
  9. 09Fixed-window rate limiting, per routeActive
  10. 10Role-based access with per-request permission checksActive
  11. 11SSO via SAML and OpenID Connect, plus two-factor authenticationActive
  12. 12Request ID and response timing on every requestActive
  13. 13One sign-in at a time: a new sign-in ends the earlier sessionActive

Questions about security?

Reach out and we’ll walk you through our security architecture in detail.

Contact usTry it free (opens in a new tab)