Laserfiche Cloud: Platform Overview & Data Protection

What Is Laserfiche Cloud?

Laserfiche Cloud is a secure online document management system that requires minimal deployment time and no on-site infrastructure or IT support staff. It enables organizations to securely manage and share documents, videos, photos, and other content as they flow through organizational workflows. It is an enterprise content management platform with built-in business process management tools, delivered as a secure, scalable Software-as-a-Service (SaaS) subscription.

With over 9,000 organizations and 6 million users worldwide, Laserfiche Cloud is trusted by agencies, school districts, and hospitals to drive secure digital transformation while automating compliance governance.

All Laserfiche Cloud systems are hosted on Amazon AWS for redundancy, security, and scalability. Laserfiche Cloud is hosted in multiple regions, with each region consisting of multiple availability zones comprised of multiple data centers. Data centers for Laserfiche Cloud Services are located in the United States, Canada, and Ireland.

Laserfiche Cloud is designed to run continuously by using data centers equipped with redundant power, networking, and connectivity to ensure reliable service even during localized failures.

Laserfiche employs encryption at every stage of data handling:
At rest: Data volumes on servers storing customer data and attachments in Laserfiche Cloud are encrypted at rest using industry-standard full-disk AES-256 encryption. Laserfiche
In transit: All data sent between Laserfiche customers and applications is encrypted in transit using Transport Layer Security (TLS) with Perfect Forward Secrecy (PFS). Laserfiche Requests over unencrypted HTTP are automatically redirected to the equivalent HTTPS endpoint. Laserfiche
Internal network communications: IPsec is used to secure all direct network communication between AWS virtual machine instances, and TLS is used to secure all network communication between AWS services, Laserfiche services, and customer programs such as web browsers.

Tenant Isolation & Access Controls

Laserfiche Cloud provides tenant isolation by logically segregating customer data between accounts. Customers do not have access to any other customer’s data or services. Laserfiche

Access within an organization is tightly controlled: there are three basic types of security — access rights, which allow you to secure documents and folders and their contents; privileges, which allow you to grant or restrict the ability to perform certain tasks across the entire repository; and field and template rights, which secure field data. In addition, security tags allow you to restrict access to documents on a document-by-document basis, and redactions allow you to restrict access to information on specific parts of document pages.

Multi-Factor Authentication & Identity

Laserfiche Cloud safeguards data with multi-factor authentication, role-based access controls, and advanced audit trails. Administrators can configure user access based on role assignments or group memberships, limiting the actions any given user can perform across the repository.

Audit Trails & Monitoring

Laserfiche Cloud supports auditing of both access and modification of objects in repositories. The repository audit log includes details of user actions, including viewing, modifying, creating, and deleting documents, and similar operations on metadata and other repository objects.

Laserfiche Cloud utilizes host-based intrusion detection systems to reduce the risk of data theft by individuals or organizations attempting to gain unauthorized access. Laserfiche Cloud’s firewall configuration settings are regularly reviewed based on industry standards.

Automated Backups & Disaster Recovery

Laserfiche Cloud customer data is backed up multiple times per day. Backups are retained for defined periods with support for point-in-time recovery. All backup data is encrypted, replicated, and stored in geographically separate data centers. Backup and restoration is tested on at least a quarterly basis.

Data Ownership & Privacy

Laserfiche makes a clear distinction between customer content and platform data: Laserfiche does not sell your data. Documents, files, and inputs you upload to Laserfiche are your own content. Like most cloud providers, Laserfiche collects limited, high-level usage data (such as feature adoption and system performance metrics) to operate and improve the platform. This data is de-identified and does not include the contents of your documents or AI prompts. Laserfiche

Laserfiche endeavors to retain only information collected where there is an ongoing legitimate business need to do so, such as providing a requested service or complying with applicable legal, tax, or accounting requirements. All employees are required to complete annual privacy training covering applicable privacy regulations and best data handling practices. Laserfiche

AI Features & Data Protection

Laserfiche’s AI tools (Smart Fields, Smart Chat, etc.) are subject to the same rigorous protections: Laserfiche AI is encrypted both at rest (AES-256) and in transit (TLS 1.2+), and Laserfiche does not and will not use customer content to develop or improve internal or external AI models. Laserfiche

For features that accept user input, Laserfiche employs industry-standard protections against prompt injection, including input filtering, validation, and other controls that keep prompts and responses within defined, limited boundaries. Your confidential content is not accessible to other customers or unauthorized third parties. Laserfiche

Compliance & Certifications

Laserfiche Cloud holds an impressive portfolio of third-party certifications:

• SOC 2 Type 2 + HIPAA: Laserfiche’s SOC Type 2 Plus covers the security requirements set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), provided within 45 CFR Sections 164.308–312. Laserfiche
• ISO/IEC 27001:2022: Laserfiche has obtained the ISO/IEC 27001:2022 certification for its information security management system (ISMS), covering its suite of SaaS and self-hosted enterprise content management and process automation applications. The certification process involved BDO USA, P.C., an external auditor conducting an audit of Laserfiche’s ISMS. Laserfiche
• DoD 5015.2: DoD 5015.2 details the Department of Defense’s baseline requirements for Records Management Applications (RMA), facilitating adequate management of records in automated environments. Laserfiche
• GovRAMP/FedRAMP (In Progress): Laserfiche has a GovRAMP (formerly StateRAMP) initiative that will address GovRAMP/FedRAMP moderate controls, with plans to achieve GovRAMP authorization by the end of Q2 2026. Laserfiche Answers
• Global Privacy Regulations: Laserfiche AI and Cloud address privacy and security standards supporting GDPR (EU), CCPA/CPRA (USA), and PIPEDA (Canada) for low to moderate risk data. Laserfiche For personal data transferred from the United Kingdom, the European Union, and Switzerland, Laserfiche provides appropriate safeguards per the Data Privacy Framework. Laserfiche

Multiple Repository Support

While Laserfiche provides robust security controls over all documents, organizations can store certain documents in separate repositories to greatly simplify compliance with strict regulatory requirements or special storage policies. Multiple repositories allow customers to organize and secure their data in the way that best fits their organization. LaserFiche

This feature is often used by cities that have a police department that wishes to use Laserfiche. In most cases, cities add an 2nd repostory that only PD staff members can access. Although this could be accomplished with Laserfiche security on one repository, cities often elect to implement a 2nd repository for ease of compliance and auditing.

Summary

Laserfiche Cloud is a well-rounded enterprise content management platform that layers security controls at every level — from physical infrastructure and network communications, to application-level access rights, audit trails, and AI safeguards. Its combination of AES-256 encryption, tenant isolation, granular access management, automated encrypted backups, and third-party certifications (SOC 2 + HIPAA, ISO 27001, DoD 5015.2) makes it a strong choice for organizations in regulated industries such as government, healthcare, and education.