Compliance & Standards
How EXPAT LEGAL meets European regulatory requirements.
Regulatory framework
EXPAT LEGAL OÜ operates as an EU-registered platform and aligns its practices with the regulations below. Each links to its official text.
Information security
EXPAT LEGAL implements information-security practices aligned with ISO/IEC 27001 principles, including:
- Encrypted data transmission (TLS 1.3)
- Access control and least-privilege principles
- Regular security reviews
- Incident-response procedures
- A vulnerability-disclosure policy (see /.well-known/security.txt)
Payment security
Payment processing is handled exclusively by Mercuryo (mercuryo.io), a licensed Electronic Money Institution authorised under EU payment-services regulations. EXPAT LEGAL does not store or process payment-card data. All payment data is subject to Mercuryo's PCI-DSS compliance programme.
MercuryoSpecialist verification standards
Every specialist passes a five-stage protocol before a profile goes live. Around 40% of applicants are rejected.
- 1
Credential submission
The specialist submits a degree certificate, a current practising licence, government-issued ID, and proof of professional indemnity insurance.
- 2
Registry verification
EXPAT LEGAL verifies the practising licence against the official professional registry of the specialist's jurisdiction of practice. For lawyers: the national bar association. For accountants: the national accountancy body. For notaries: the national notary council.
- 3
Identity proofing
The identity document is verified against the specialist's face by video, aligned with the eIDAS identity-assurance level "Substantial".
- 4
Structured competency interview
A recorded interview of at least 30 minutes, conducted by EXPAT LEGAL compliance staff, covering jurisdictional knowledge, ethical obligations, case-handling procedures and acknowledgement of platform policy.
- 5
Probationary monitoring
The first 10 consultations are subject to enhanced monitoring. A specialist must maintain at least a 4.0 rating to keep active status.
Client rights
Under EU consumer-protection law, clients using EXPAT LEGAL have the following rights:
Right to refund
If the service is not provided — within T+3 business days.
Right to dispute
Any transaction, within 72 hours of the scheduled service.
Right to data access
Request all personal data held about you (GDPR Art. 15).
Right to erasure
Request deletion of your personal data (GDPR Art. 17).
Right to escalation
Escalate unresolved disputes to the Estonian Consumer Protection Board.
Contact for rights requests:
dpo@expatlegaleu.it.com