Laserfiche Security and Compliance

Security Certifications and Compliance Frameworks

SOC 2 Type 2 Plus

This report details the controls for Laserfiche Cloud related to the criteria for the security, availability and confidentiality principles set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Criteria). To view a copy of this report, please contact us.

ISO/IEC 27001:2022

Laserfiche has obtained the ISO/IEC 27001:2022 certification for its information security management system (ISMS) within the scope defined by its Statement of Applicability, covering its suite of SaaS and self-hosted enterprise content management and process automation applications.

HIPAA

Laserfiche’s SOC Type 2 Plus covers the security requirements set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), provided within Title 45 Code of Federal Regulations Sections 164.308 – 312 (45 CFR Sections 164.308-312) (the Security Requirements).

Web Content Accessibility Guidelines 2.2 AA

Laserfiche has published VPATs and ACRs available for all Laserfiche Cloud and self-hosted products. Alignment to the WCAG 2.2 Level AA standard is the basis of our approach to compliance with Section 508 and EN 301 549 requirements. See accessibility details…

DoD 5015.2

DoD 5015.2 details the Department of Defense’s baseline requirements for Records Management Applications (RMA), that facilitate adequate and appropriate basis for addressing the basic challenges of managing records in the automated environment that increasingly characterizes the creation and use of records. Laserfiche Cloud records management controls are based on our self-hosted Department of Defense 5015.2 version 3-certified electronic records management capabilities.

SEC Rule 17a-4

Laserfiche features support non-alterable record archival requirements such as WORM (write once, read many) used to address SEC Rule 17a-4 for broker dealers. Beyond financial services, Laserfiche’s controls can also be applied to support records management practices for electronically stored information (ESI) requiring prevention of any unauthorized alternations or deletions of digital records.

HECVAT

Laserfiche has completed the Higher Education Community Vendor Assessment Toolkit (HECVAT) questionnaire. Contact us for more information.

NIST 800-53

Laserfiche security controls are aligned with NIST 800-53.

GovRamp Core Verified

Coming in Q3 2026

Contact us for more information.

CJIS Ready

Coming in Q3 2026

Contact us for more information.

Security Controls

Below are some of the security controls Laserfiche software includes. If you have questions about a particular security solution or control, please contact us directly.

Single sign-on

Laserfiche Cloud supports single sign-on with Active Directory Federation Services (AD FS) and SAML authentication with identity providers such as Okta and Azure Active Directory.

Repository audit log

The Laserfiche Cloud repository audit log includes details of user actions, including viewing, modifying, creating and deleting documents, and similar operations on metadata and other repository objects.

Fine-grained access control

Administrators can use access rights to limit and control access to individual documents and objects. For example, security tags restrict access to documents on a document-by-document basis.

Intrusion detection

Laserfiche Cloud utilizes host-based intrusion detection systems to reduce the risk of data theft by individuals or organizations attempting to gain unauthorized access.

Access rights

Administrators can configure access rights and privileges to limit actions that users can perform across the repository based upon role assignments or group memberships.

AI governance

Laserfiche AI data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Laserfiche does not utilize any of your data to train internal or external AI models.

Password policies

Laserfiche Cloud supports industry-standard password controls, such as password minimum length, complexity and history.

Penetration testing

Laserfiche engages third-party vendors to conduct external penetration testing of the Laserfiche Cloud system.

Vulnerability scanning

Laserfiche performs a vulnerability scan of backend servers that run in the Laserfiche Cloud hosting environment.

Firewalls

Laserfiche Cloud’s firewall configuration settings are regularly reviewed based on industry standards.

Repository application auditing

Laserfiche Cloud supports auditing of both access and modification of objects in repositories.

Laserfiche is committed to privacy.

Our commitment

At Laserfiche, we have embraced a culture of privacy, which includes embedding privacy-by-design in our engineering efforts, and have implemented controls and policies throughout our organization. Laserfiche is a B2B company based in California. The State of California has passed strict, broad privacy regulation through the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) while the General Data Protection Regulation (GDPR) leads the European Union’s privacy efforts. Many other countries, states and territories have implemented privacy regulations as well. Laserfiche endeavors to continually adapt and adhere to ever-evolving regulations that apply to its business.

Operational privacy

Operationally, we strive to keep our stakeholders’ data secure and retain only information we collect from you where we have an ongoing legitimate business need to do so, like providing you with a service you have requested, or to comply with applicable legal, tax or accounting requirements.

Privacy training

At Laserfiche, all employees are required to complete annual privacy training which covers applicable privacy regulations and data handling best practices.

Laserfiche documentation

In addition to what we communicate in our Privacy Notice, our Cloud Subscription Agreement with accompanying Data Processing Addendum specific to the Laserfiche Cloud platform addresses data privacy regulations including GDPR, CCPA and PIPEDA.

International transfers

For personal data transferred from the United Kingdom, the European Union and Switzerland, we provide appropriate safeguards per the Data Privacy Framework. To learn more, visit the “International Transfers” section of the Privacy Notice.

Information we collect

We collect information that you provide directly to us only for legitimate business purposes. For example, when you manage your user profile, participate in interactive features (such as the Contact Us page), request newsletters or other marketing communications, request customer support, enter login information, or otherwise communicate with us. To learn more visit the “Information We Collect” section of the Privacy Notice.

You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails we send you. To learn more, visit the “How Laserfiche Uses and Shares the Information We Collect” section of the Privacy Notice.

To read our complete Privacy Notice, visit our Privacy Notice page.

Contactez-nous pour vos besoins en ECM

Que vous ayez des questions sur le produit, des besoins d’assistance, ou en vue de notre collaboration, nous sommes là pour vous aider dans votre parcours de transformation numérique. Remplissez le formulaire et un membre de l’équipe Laserfiche vous contactera dès que possible.

MSIG Puts Customers First in Claims Processing

The focus on customer experience was one of the core drivers in the process automation strategy for MSIG Hong Kong (MSIG), embracing customer needs in light of a shifting technological landscape and major disruptions. The company sought to phase out legacy systems and increase efficiency for its claims submission service, requiring a highly adaptable content services tool to do so.

Since implementing Laserfiche for claims in 10 different product lines, the MSIG claims team can now manage all claims in a centralized platform, allowing staff to focus on more important claim assessment tasks. By investing in digital transformation for the organization’s EASY Claims System, MSIG has been able to differentiate itself in Hong Kong’s highly competitive insurance industry. The organization’s EASY Claims system has received wide recognition in Asia’s insurance landscape, as well as won MSIG a number of industry awards. In 2019, the company won a Laserfiche Run Smarter Award; in 2024, MSIG earned the Laserfiche Run Smarter Award for Best Program ROI.

“Laserfiche is the catalyst for our users and customers to improve their day-to-day work experiences,” said Alan Yue, Senior Vice President of Information Technology at MSIG.

Seeking a means to respond to customer needs and enable staff to transition to remote working arrangements, Laserfiche has also helped MSIG successfully achieve business continuity, maintaining a high level of operational efficiency and customer service through dedicated portals.

A Claims Processing System Made EASY

Providing general insurance solutions for more than 100 years, MSIG Holdings (Asia) Pte. Ltd. has a history of combining global and local best practices in the organization’s customer-focused approach, believing that the relationship between insurance companies and customers should be based on trust. This commitment to customers led the organization to reassess its reliance on manual legacy systems for process management. MSIG recognized that customers are embracing more digital solutions, presenting an opportunity to make correspondence with clients more seamless and efficient, as well as reengineer the IT infrastructure.

“As a core part of our business, the claims system is one of the most important parts of the MSIG customer journey,” Yue said. “We realized that the entire process was actually quite paper-driven, making it the perfect candidate to digitalize and automate.”

MSIG initiated a business transformation program known internally as “Transformer” in 2017. Laserfiche was chosen as MSIG’s core digital transformation solution with the goal of automating manual and paper-based core business processes, targeting the customer claims submission platform as a starting point. Eventually named EASY Claims, the system improved both operational efficiency and service with a focus on the customer experience. The platform supports self-service submissions, as well as provides transparency of claims status to MSIG customers.

Within the first three months of launch, EASY Claims significantly improved efficiency at MSIG, automating over 100,000 tasks that previously required manual user input.

Additionally, the number of clients submitting claims via the new system has increased by up to 80%. This has streamlined and simplified the claims submission process for customers, aligning with shifting technological expectations and improving response times.

The EASY Claims system also improved the experience for staff processing customer submissions. Originally, acknowledging a newly submitted claim could take two days. Today, it takes fewer than 15 minutes. This translates to a savings of more than 200 work days a year for the claims processing staff organization-wide. The property claims management team specifically was able to save 57 days a year through the EASY Claims system.

The initiative has created the opportunity for ongoing optimization. In 2022, MSIG introduced Zero Touch for Helper insurance plan claims. Zero Touch is MSIG’s digital solution for claims assessment, enabling customers to submit their claims form, supporting documents and contact details online. The system then checks the customer’s claims history, policy validity and claim payment amount. For eligible clinical or dental expenses claims, payments are settled in just two working days. MSIG is planning to add Zero Touch to more products, creating a more seamless customer experience across product lines.

Along with facilitating claims submission for customers and acknowledgement in the backend, the automated process has helped save 12 days a year during the claims finalization stage. In terms of improved staff efficiency, MSIG has increased overall productivity by 1.4 times per hiring cycle within the Claims department alone. As a team with a significant amount of customer facetime and interaction, the Claims department’s increased productivity has improved both employee and customer experience.

In 2022, MSIG Hong Kong honored over HK$356 million, with a claims ratio of 92.9%, seeing a consistent increase for three consecutive years. The organization also reduced the number of complaints received by 50% in two years.

As the platform that powers the EASY Claims system, Laserfiche has helped to ensure a high level of customer service and a user-friendly, customer-oriented interface. The platform removes friction from the process of filing a claim, with intuitive features such as a “save-as-draft” function that enables customers to retrieve incomplete forms at any time using an email link, and smart suggestions that provide basic information and documents that customers will need to make a claim before they fill out the form. Customers can also receive SMS messages, email confirmations and tracking numbers to stay informed of the status of their claims.

“Claims is only the beginning of our digital transformation. Since implementing Laserfiche, we are looking at expanding to multiple channels, underwriting teams and core business processes to digitize and automate as well,” said Yue.

Investing in the Future

Recognizing that the insurance industry has historically relied on legacy processes, MSIG looked to digitize its claim service, rebuilding it to address both staff and client needs. With core business processes established between 10 to 20 years prior, the firm had an intimate knowledge of its users’ needs, refreshing a part of its business that focused heavily on customer and employee input. Working with Laserfiche to develop a nimble IT strategy, MSIG has been able to improve the customer and back-end experience within the claims process without disrupting day-to-day operations.
“Both business and technology landscapes have experienced so much rapid change and development,” said Yue. “These are the primary driver for MSIG’s digital transformation program, equipping us to anticipate our future needs as well as our customer expectations.”

Experiencing unprecedented and unanticipated changes in 2020, the EASY Claims System has proven itself to be highly adaptable, highlighting the need for digital transformation at MSIG. With claims as an obvious starting point, MSIG is looking to expand Laserfiche to other departments and processes. The organization is preparing to introduce claims process tracking for customers, allowing customers to track their claims in real time through the MSIG app or website — further enhancing visibility and continuing to build trust with customers.

“We now have a way to differentiate ourselves within Hong Kong’s insurance marketplace,” said Yue. “Laserfiche has helped users throughout the company to identify opportunities to improve day-to-day work. The sky is the limit.”

To learn more about how Laserfiche drives digital transformation, schedule a consultation today.