Information Security and Data Protection.

Effective Date: September 16, 2026

This document describes the technical, organizational, and legal measures Manifest applies to Client Data in the course of providing global immigration services. It is the document referenced in the data protection clause of the Manifest Master Services Agreement (“MSA”). It is intended for our corporate clients — in particular their legal, privacy, information security, procurement and global mobility teams.

Nothing in this document reduces or replaces the commitments set out in the MSA, any Data Processing Agreement (“DPA”) or any other executed agreement between the parties. Where this document and an executed agreement differ, the executed agreement prevails.

This document contains the following sections:

• Summary for client legal and security teams
• 1. Scope and application
• 2. Governance and accountability
• 3. Legal and regulatory framework
• 4. Data protection roles and contracting
• 5. Categories of data and lawful bases
• 6. Confidentiality and privilege
• 7. Encryption and key management
• 8. Access control
• 9. Infrastructure, hosting and physical security
• 10. Subprocessors and third-party disclosure
• 11. Secure development and change management
• 12. Vulnerability management, testing and monitoring
• 13. Security incident response and breach notification
• 14. Business continuity, backup and disaster recovery
• 15. Data retention and deletion
• 16. Individual rights
• 17. Artificial intelligence and automated processing
• 18. Compliance, certification and independent assurance
• 19. International data transfers
• 20. Contact
• 21. Changes to this document

Summary for client legal and security teams

Immigration data is unusually sensitive. Our controls are designed around the reality that immigration matters involve passports, biometrics, medical examinations, criminal history, family relationships and children’s data — much of which is special category personal data under GDPR Article 9.

• Two layers of confidentiality. Client Data is protected both by data protection law and by attorney-client privilege and the legal profession’s confidentiality rules, which are more restrictive than commercial confidentiality obligations.
• Independently assessed. Manifest maintains a SOC 2 Type II attestation covering security, confidentiality, and privacy. The report is available to clients under NDA.
• ISO/IEC 27001 in progress. We operate an information security management system aligned to ISO/IEC 27001:2022 and are working toward certification. We do not yet hold a certificate, and we do not describe ourselves as ISO 27001 certified.
• GDPR and UK GDPR. Encryption in transit and at rest, role-based access control, MFA, logging, tested backups, defined breach notification timelines, and a documented lawful basis for every category of data we process.
• Transfers are papered. Where Client Data moves out of the EEA or the UK, transfers rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, supported by a transfer impact assessment.
• No AI training on your data without consent. Client Data is not used to train models, and no immigration matter is decided by automated means without qualified human legal review.
• Assurance on request. SOC 2 report, penetration test summary, subprocessor list, policy set, and completed security questionnaires are available to clients under NDA.

1. Scope and application

This document applies to:

• Client Data — all information a client, or an individual whose matter the client sponsors, provides to Manifest or that Manifest generates in the course of an immigration matter;
• Manifest Legal Services LLC and the lawyers and staff acting for it;
• the Manifest OS platform, operated by Manifest Legal Tech, Inc., through which matters are managed, documents are exchanged, and case status is reported;
• all Manifest personnel, contractors, and subprocessors with access to Client Data.

Manifest OS is a technology platform and is not a law firm; the Manifest Law firm entity provides legal services. Both are in scope of this document because both handle Client Data.

2. Governance and accountability

Information security is owned at the executive level by the VP of Engineering, with legal and privacy compliance owned by General Counsel. Responsibilities include policy approval, risk acceptance, incident escalation, and annual review.

Manifest maintains a documented policy set covering, at minimum: information security, acceptable use, access control, cryptography, secure development, change management, incident response, business continuity, data retention, vendor management, and privacy. Policies are reviewed at least annually and after any material change to our systems, services, or regulatory environment.

All personnel complete information security and confidentiality training at onboarding and at least annually thereafter, with additional privilege and confidentiality training for personnel working on client matters. Personnel with privileged or production access are subject to background screening to the extent permitted by local law.

3. Legal and regulatory framework

Manifest’s handling of Client Data is governed by, as applicable:

• EU GDPR (Regulation (EU) 2016/679) and applicable Member State law;
• UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, whose data protection provisions came fully into force on 19 June 2026;
• applicable US federal and state privacy laws, including the CCPA/CPRA and comparable state statutes;
• the rules of professional conduct of each jurisdiction in which our lawyers are admitted, including the duty of confidentiality (ABA Model Rule 1.6 and state equivalents), which applies independently of, and in addition to, data protection law;
• immigration-specific recordkeeping obligations imposed on our clients or on us by the relevant immigration authorities.

Because immigration matters are cross-border by definition, a single matter may engage several of these regimes at once. Our default position is to apply the most protective applicable standard rather than the minimum.

4. Data protection roles and contracting

The parties’ roles under GDPR and UK GDPR are set out in the MSA and, where applicable, in a separate DPA. In outline:

• When Manifest provides legal advice and represents an individual or the client before an immigration authority, the Manifest law firm entity generally acts as an independent controller, because the purposes and means of that processing are determined by professional and legal obligations that a client cannot lawfully direct.
• Where Manifest processes Client Data on the client’s documented instructions and not for its own purposes — for example, hosting and administering client-configured workflows in Manifest OS — Manifest acts as a processor, and a DPA meeting Article 28 requirements governs that processing.

A single engagement will often involve both roles. The applicable DPA and, where relevant, transfer mechanism, is executed alongside or as an annex to the MSA. Manifest will enter into the client’s own DPA where its terms are compatible with our professional obligations.

5. Categories of data and lawful bases

Immigration matters require categories of data that most commercial vendors never touch. We process, as necessary for the matter:

Lawful bases relied on include performance of a contract, compliance with a legal obligation, legitimate interests, and — for special category and criminal offence data — Article 9(2)(b) (employment and social security), Article 9(2)(f) (establishment, exercise or defence of legal claims), Article 9(2)(a) (explicit consent) and the corresponding UK conditions under Schedule 1 of the Data Protection Act 2018, as applicable.

Data minimization. We collect only what the relevant immigration authority, or the matter itself, requires. Where a document is needed for verification but not for filing, we verify and do not retain it. Sensitive documents are requested through the platform rather than by email.

6. Confidentiality and privilege

Client Data received in the course of legal representation is subject to attorney-client privilege and the professional duty of confidentiality. Practically, this means:

• Manifest does not disclose Client Data to third parties except as necessary to conduct the matter, as instructed by the client or the individual, or as required by law.
• Matters are segregated at the platform level. Access is granted per matter, not per organization, and client tenants are logically isolated from one another.
• Where a client’s internal stakeholders (HR, mobility, managers) require case visibility, access is scoped by role so that sponsoring employers see status and milestones without unnecessary exposure to an individual’s sensitive personal or family information.
• Manifest maintains conflict-checking and, where required, information barriers between matters.

7. Encryption and key management

• In transit: TLS 1.2 or higher for all external connections, with modern cipher suites; HSTS enforced on web properties.
• At rest: AES-256 encryption for databases, object storage, and backups.
• Key management: keys are held in a dedicated managed key management service, with access restricted to a small number of authorized personnel, logged and periodically reviewed. Keys are rotated in line with our cryptography policy.
• Credentials: passwords are stored using a modern salted password-hashing function; secrets are held in a managed secrets store and never in source code.

8. Access control

• Role-based access control on the principle of least privilege; production access is granted only where a documented business need exists.
• Multi-factor authentication is mandatory for all Manifest personnel and for administrative access to production systems.
• Single sign-on is available to corporate clients, allowing clients to enforce their own authentication and offboarding policies for their users.
• Access rights are reviewed at least quarterly and on any role change.
• Access is revoked within 24 hours of a person leaving Manifest or ceasing to work on a matter.
• Administrative and data-access events are logged; logs are retained in accordance with the retention policy and monitored for anomalous activity.

9. Infrastructure, hosting and physical security

Manifest OS is hosted on Google Cloud Platform. Our provider operates audited data centers with 24/7 physical security, access control, environmental controls and redundancy, and maintains its own SOC 2 and ISO 27001 assurance, which is available for review.

Manifest personnel do not hold Client Data on local devices as a matter of course. Corporate endpoints are managed and encrypted at the disk level.

10. Subprocessors and third-party disclosure

Manifest engages a limited set of subprocessors — principally cloud hosting, communications, e-signature, document processing and support tooling. For each:

• a written agreement imposes data protection obligations no less protective than those Manifest owes the client;
• a security and privacy review is completed before engagement and repeated periodically;
• an appropriate transfer mechanism covers transfers outside the EEA and UK.

Separately from subprocessors, immigration work necessarily involves disclosure to government authorities and third parties integral to the matter — immigration and labor authorities, consulates, courts, medical practitioners designated by the authority, credential evaluators, and local counsel in the destination jurisdiction. These disclosures are made only as required to advance the matter, and local counsel are engaged under confidentiality and data protection terms.

11. Secure development and change management

Security is built into the development lifecycle: peer code review, dependency and container scanning, static analysis, secrets detection, and pre-release validation.

Production changes are documented, reviewed, and approved; changes are traceable to an author and an approval.

Environments are separated. Production Client Data is not used in development or test environments; where realistic test data is required, it is synthetic or anonymized.

12. Vulnerability management, testing and monitoring

• Continuous automated vulnerability scanning of infrastructure and application dependencies, with remediation targets by severity according to the vulnerability policy.
• Independent penetration testing at least annually; an executive summary is available to clients under NDA.
• Centralized logging and alerting with defined escalation paths.
• A vulnerability disclosure channel for external researchers at security@manifestos.com.

13. Security incident response and breach notification

Manifest maintains a documented incident response plan defining severity levels, roles, escalation, containment, forensics, remediation, and post-incident review. The plan is tested at least annually.

If Manifest becomes aware of a personal data breach affecting Client Data, Manifest will:

• notify the client without undue delay and in any event within 48 hours of confirming the breach;
• provide the information the client needs to meet its own obligations, including the nature of the breach, categories and approximate volume of data and individuals affected, likely consequences and measures taken;
• cooperate with the client’s investigation and reasonable requests for information;
• where Manifest is the controller, notify the competent supervisory authority within 72 hours and affected individuals where required under Articles 33 and 34.

Manifest does not require the client’s consent to make notifications it is legally obliged to make.

14. Business continuity, backup and disaster recovery

• Client Data is backed up on a daily schedule, with backups encrypted and stored separately from production.
• Recovery objectives: RPO is 24 hours, and RTO is 24 hours.
• Restore procedures and the disaster recovery plan are tested at least annually.
• Matter deadlines are tracked so that immigration filing dates are not missed as a result of a service interruption; critical deadline data is recoverable independently of the primary application.

15. Data retention and deletion

Retention in a legal practice is not purely a matter of client preference. Manifest retains matter files for the period required by the applicable rules of professional conduct, statutory limitation periods and immigration recordkeeping obligations. After that period, data is securely deleted or irreversibly anonymized.

Manifest shall securely and permanently dispose of (e.g., erase, destroy, or render unreadable) all Client Data upon the Client’s request, except where retention is required by law or professional rules. Where we must retain, retention is limited to that purpose, access is restricted, and the data remains subject to this document. We will tell the client what is retained and why rather than deleting records we are obliged to keep.

16. Individual rights

Manifest supports the exercise of data subject rights — access, rectification, erasure, restriction, portability, objection, and rights in relation to automated decision-making — under GDPR, UK GDPR and other applicable law.

• Where Manifest is a processor, we forward requests to the client without undue delay and assist in responding.
• Where Manifest is a controller, we respond directly within the statutory time limit.
• Requests are handled at privacy@manifestlaw.com.

Legally recognized exemptions may apply — in particular for legal professional privilege, the establishment or defense of legal claims, and the rights of other individuals named in a matter. Where an exemption is applied, we record the reason.

Individuals may also complain to Manifest directly; complaints are acknowledged and responded to in line with applicable law, including the complaint-handling requirements introduced in the UK by the Data (Use and Access) Act 2025.

17. Artificial intelligence and automated processing

Manifest uses AI-assisted tooling to draft, review and organize immigration filings. The following commitments apply:

• No training on Client Data. Client Data is not used to train or fine-tune models without the client’s explicit consent. Contractual terms with AI providers prohibit use of our inputs and outputs for their own model training.
• Human legal judgment is not delegated. A qualified lawyer reviews and is accountable for advice, strategy and every filing. No decision producing legal effects for an individual is made solely by automated means within the meaning of GDPR Article 22.
• Confidentiality flows down. AI subprocessors are subject to the same review, contractual and transfer requirements as any other subprocessor.
• Special category and criminal offence data is subject to additional restrictions on automated processing.

18. Compliance, certification and independent assurance

• SOC 2 Type II. Manifest maintains a SOC 2 Type II attestation report covering the security, confidentiality, and privacy trust services criteria, issued by an independent auditor. Available to clients under NDA.
• ISO/IEC 27001:2022. Manifest’s information security management system is designed and operated in alignment with ISO/IEC 27001:2022, and Manifest is working toward certification. Manifest does not currently hold an ISO/IEC 27001 certificate and does not represent itself as certified.
• GDPR and UK GDPR. Compliance is maintained through records of processing, data protection impact assessments where required, transfer impact assessments, vendor due diligence and the contractual framework described in section 4.
• Client due diligence. On request and under NDA, Manifest provides the SOC 2 report, penetration test summary, subprocessor list, relevant policy extracts, insurance certificates and completed security questionnaires. Audit rights, where granted, are as set out in the DPA.

19. International data transfers

Immigration work requires moving personal data between jurisdictions; that is the service. Manifest addresses transfer compliance as follows:

• Transfers from the EEA rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with the applicable modules, supported by a transfer impact assessment and, where needed, supplementary technical and organizational measures.
• Transfers from the UK rely on the International Data Transfer Agreement or the UK Addendum to the EU SCCs.
• Transfers to a country benefiting from an adequacy decision rely on that decision.
• Where a transfer to an immigration authority is required to progress the matter, the transfer is made on the basis applicable to that authority’s request, and the individual is informed.

20. Contact

21. Changes to this document

Manifest reviews this document at least annually and updates it when our practices, systems, or legal obligations change materially. Material changes affecting client commitments are communicated in accordance with the MSA. The version and effective date at the top of this document identify the current text; prior versions are available on request.

Manifest OS is a product of Manifest Legal Tech, Inc., which is not a law firm and does not provide legal services. Legal services are provided by the Manifest law firm entity party to the MSA.