300 lawyers on an AI platform in two months: full data isolation, customer-held keys and SSO

Context

The legal department of a large organisation decided to adopt Legora. The platform is SaaS, but in an organisation of this size the way it is launched decides whether it is secure, compliant with policies and actually used by people.

Innowacje 4 IT joined the project at the contract stage: we reviewed it for compliance, governance and technical requirements, then took responsibility for the launch architecture, identity, encryption keys and user onboarding.

Challenge

• How to isolate the data?The vendor offered a fully isolated environment or an intermediate option with shared infrastructure and logical isolation. They differ in cost, time to launch, division of responsibility and what can be demonstrated to an auditor.
• Who holds the keys?Legal documents are the most sensitive data category in the organisation. Vendor-only encryption was not enough; the keys had to remain under the customer's control.
• How to onboard 300 people without chaos?The legal department wanted full control over who gets access and when, and ultimately sign-in through the corporate identity, with no new passwords and immediate revocation when someone leaves.

What we did

1A contract read from the organisation's side

Clauses on data processing and location, responsibilities, governance and technical requirements were checked and refined before signing, not discovered after go-live.

2Choosing the isolation model

We compared both options in business terms: where the data lives, who has operational access, how recovery works, how long launch takes and what it costs per year. Given the nature of the entity and the way the legal team works, full environment isolation was chosen.

3Customer-held keys

We set up Azure Key Vault with an HSM on the customer side, managed by their local team, and connected it to the platform. Data is encrypted with keys the organisation fully controls: rotation and revocation independent of the vendor.

4Access in two iterations

By decision of the legal department, the launch started with the platform's internal accounts and controlled invitations, giving full control over who gets access and when. In the second iteration we rolled out single sign-on through Microsoft Entra ID using OIDC, with multi-factor authentication on the identity side.

5Two launch waves

A pilot environment first, then production. Pilot users were moved in the second iteration because of the migration specifics, so nobody worked in two environments at once.

6Go-live support

Password resets were not an issue. The biggest topics were multi-factor authentication and everyday user questions, which we handled directly so the customer's helpdesk was not loaded.

Under the hood

• Deployment model: fully isolated environment.
• Identity: stage 1 platform-internal accounts with invitation control; stage 2 SSO via Microsoft Entra ID (OIDC), MFA on the identity provider side.
• Keys: Azure Key Vault with HSM on the customer side, managed by the local team.
• Rollout: pilot environment, then production; invitations in two waves from the admin portal.
• Timeline: about two months from decision to full access.

Result

• About 200 people were working on the platform within the first month; the rest joined gradually, mostly due to holidays.
• Platform data is encrypted with keys under the organisation's control, not only the vendor's.
• The full-isolation decision is documented and can be shown to an auditor.
• The contract was signed with a clear view of the compliance, governance and technical obligations.

Why this matters for other companies

Every SaaS launch in an organisation above a few dozen people raises the same three questions: isolation, keys, identity. That is not a job for the platform's sales team but for someone looking from the organisation's side. We apply the same approach to Microsoft 365, line-of-business systems and cloud tools.

The client's name is withheld at their request. Legora is the name of the deployed product; we do not describe the platform's features and we are not its reseller.