Skip to content
LEF LEF Docs
GitHubLinkedIn

Compliance & alignment

This page is a summary for client/vendor questions. It points to the underlying policies (“controls”) and describes how we align with common standards. LEF is not certified unless explicitly stated.

Baseline controls

Section titled “Baseline controls”
Information classification
Classification levels and handling rules.
Access control
How access is granted, reviewed, and revoked.
Incident response
How we respond to and learn from security incidents.
Vulnerability management
How we track, prioritize, and remediate vulnerabilities.
Backup and recovery
Backup strategy and recovery responsibilities.
Data retention and deletion
Retention rules and secure deletion expectations.
NDA defaults
Default NDA positions and negotiation guardrails.

Compliance and alignment overview

Section titled “Compliance and alignment overview”

LEF follows a practical, risk-based approach to compliance. For each project, applicable standards are considered and safeguards are applied according to client requirements and legal obligations.

For internal planning (gap tracking, evidence, and documentation structure), see ISO/IEC 27001 readiness.

Lei Geral de Proteção de Dados — Brazil

LEF aligns with LGPD through baseline practices such as:

  • Processing personal data only when necessary for the project scope.
  • Restricting access based on role and project assignment.
  • Using encrypted transport (TLS/HTTPS) and access-controlled storage (e.g., Microsoft 365 and private cloud).
  • Following incident response and retention/deletion procedures when required.