Standing
Security & compliance.
Lexitio is built for legal professionals who handle sensitive, privileged client information. Every architectural and operational decision assumes your data requires the highest level of protection — not because a regulator demands it, but because attorney-client privilege is the foundation of legal practice.
LAST UPDATED · OCTOBER 8, 2026
TLS 1.2+Encryption at rest (database)PostgreSQL row-level securityRole-based accessTwo-factor authentication availableAppend-only audit log
Encryption
TLS 1.2 or higher in transit with HTTPS enforced; the database is encrypted at rest by our database provider.
AI processing
Content is sent to AI model providers through their business APIs, under those providers' API terms. Lexitio uses the following AI providers: Anthropic, Voyage AI, OpenAI and Fireworks.
Data isolation
Each firm's data is separated in the application and by PostgreSQL row-level security in the database.
Access controls
Role-based permissions, with two-factor authentication available to every user.
Private file storage
Each firm's files are stored under that firm's own storage path and served only through firm-scoped checks.
Audit + review
An append-only log records sign-ins, permission changes, matter events and AI queries; AI drafts, strategy and answers with unverified citations are flagged for attorney review.
Citation verification
Citations in AI answers are verified against free primary-law sources before they can show as verified. In a 124-citation live test against free primary-law sources (classes: 41 genuine, 41 miscited, 42 fabricated), 0 fabricated and 0 miscited citations were marked verified; 41 of 42 genuine citations verified.
Chapter One
How your data is isolated and protected.
Each firm's data is kept separate from every other firm's at two independent layers — the application and the database itself — and is encrypted in transit.
Firm-scoped application queries, plus PostgreSQL row-level security as a second, independent layer
TLS 1.2+ in transit, database encryption at rest by our provider, bcrypt password hashing
Role-based permissions enforced by the API, not just the interface
Two-factor authentication available to every user; rate-limited sign-in; signed-out sessions blocklisted
API keys hashed before storage
No architectural decision here assumes trust — every layer checks for itself.
Exhibit A — Isolation, Encryption & Access
Tenant isolation
✓
Application-level isolation
The application scopes its queries to your firm.
✓
Database-level Row Level Security
PostgreSQL row-level security is enabled and forced on tenant-scoped tables — a second, independent layer. The application will not start with a database role that could bypass it.
Encryption
✓
Encryption in transit
TLS 1.2 or higher; unencrypted HTTP is redirected to HTTPS.
✓
Encryption at rest
Our managed database provider encrypts the database at rest, and our storage provider encrypts database backups at rest.
✓
Password hashing
bcrypt with a unique salt per password. Plaintext passwords are never stored.
Access control
✓
Role-based access control
Admin, lawyer, analyst, paralegal and viewer roles — enforced by the API, not just the interface.
✓
Sign-out invalidation
Signed-out sessions are blocklisted and rejected before they expire.
✓
API keys
Keys are hashed before storage and act with the role of the user who created them.
✓
Two-factor authentication and rate limiting
Authenticator-app (TOTP) two-factor authentication is available to every user; sign-in attempts are rate-limited, and repeated failures trigger a temporary lockout.
Exhibit B — Operations & Incident Response
Audit logging
✓
Audit log
Sign-ins, permission changes, matter events and AI queries are logged with user, firm, time and IP address.
✓
Append-only
The database rejects any change to or deletion of an audit record.
✓
Firm-accessible logs
Firm admins can view their firm's audit log in the app — no support ticket needed.
Infrastructure
✓
Managed cloud providers
The application runs on established cloud hosting, with a managed PostgreSQL database and object storage.
✓
Offsite backups
Database backups are copied to separate offsite storage.
✓
Isolated services
Application services run in separate containers; database connections require credentials.
Incident response
✓
Monitoring
Application logs and errors are collected centrally.
✓
Containment
Row-level security limits what any single compromised session can reach.
✓
Notification
Affected firms are notified of a confirmed breach as required by applicable law.
Chapter Two
How we operate, and how we respond.
Sign-ins, permission changes, matter events and AI queries are recorded in an append-only audit log. The application runs on managed cloud providers, with database backups copied offsite.
Append-only audit log the database will not let anyone edit or delete
Managed cloud hosting; services in separate containers
Database backups copied to separate offsite storage
Affected firms notified of a confirmed breach as required by law
Vulnerability disclosure. If you believe you've found a security vulnerability in Lexitio, report it to security@lexitio.com. We review every report and work with researchers on responsible disclosure — we do not pursue legal action against anyone who follows it.
AI processing & data use
How AI providers handle your content.
Lexitio sends the content you submit to AI features to the AI providers listed below.
- Provider terms
- AI features send content to AI model providers through their business APIs. Those providers' API terms govern how they handle it. Lexitio uses the following AI providers: Anthropic, Voyage AI, OpenAI and Fireworks. A full list of subprocessors is available on request.
- Conversation history
- Your conversations with Lexi are saved in your firm's account so you can return to them.
- Firm boundary
- AI requests use your firm's own data only; another firm's data is never available to them.
Contact
Questions, or a diligence request.
Security issues — security@lexitio.com
Enterprise requests — enterprise@lexitio.com