Last updated: April 23, 2026
Lexitio is built for legal professionals who handle sensitive, privileged client information. Every architectural and operational decision is made with the assumption that your data requires the highest level of protection — not because a regulator demands it, but because attorney-client privilege is the foundation of legal practice.
Each firm's data is completely separate from every other firm.
Every database query is filtered by tenant_id. A query from Firm A cannot return data belonging to Firm B — this is enforced at the ORM layer on every route.
PostgreSQL Row Level Security (RLS) policies are applied to all tenant-scoped tables as a second enforcement layer. Even if an application bug skips the ORM filter, the database itself will only return rows for the current tenant.
No table that contains firm data is shared across tenants without an enforced tenant_id predicate. Cross-tenant data leaks are structurally impossible in normal operation.
Data is encrypted in transit and at rest.
All connections to Lexitio are protected by TLS 1.2 or higher. Unencrypted HTTP connections are redirected to HTTPS. API connections use TLS with strong cipher suites.
All uploaded documents, case files, and evidence are stored in Amazon S3 with server-side AES-256 encryption (SSE-S3). Database volumes are encrypted at the infrastructure level.
Passwords are hashed using bcrypt with per-user salts. We never store plaintext passwords, and password hashes are never transmitted or logged.
Who can see and do what is strictly enforced.
Every user is assigned a role (admin, attorney, paralegal, staff). Permissions are enforced at the API layer on every endpoint — there is no UI-only permission check.
Authentication uses signed JWT tokens. Logged-out tokens are stored in a blocklist and rejected on every subsequent request, even before expiry.
Programmatic access uses API keys (sk-lex_ prefix) with per-key permission scopes. Keys are hashed before storage.
Login attempts are rate-limited. Accounts are locked after repeated failed attempts. Session tokens expire automatically.
MFA via TOTP (Google Authenticator, Authy) is available for all accounts and strongly recommended for admin users.
Every sensitive action is recorded with a permanent, tamper-evident trail.
Every matter creation, document upload, AI query, user login, permission change, and data export is logged with user_id, tenant_id, timestamp, IP address, and action details.
Audit logs are retained for a minimum of 7 years to support legal and regulatory requirements. Logs are append-only and cannot be deleted or modified.
Firm administrators can view their own audit log at any time from the Settings dashboard without contacting support.
Resilient hosting with daily backups and offsite replication.
Lexitio runs on dedicated cloud infrastructure in the United States. No data is stored in consumer-grade or shared hosting environments.
PostgreSQL is backed up daily via automated pg_dump. Backups are compressed, encrypted, and shipped to Backblaze B2 (offsite object storage) with 30-day retention.
Backup integrity is verified by periodic restore tests. If a backup cannot be restored, we treat it as if no backup exists.
All services run in isolated Docker containers with no unnecessary network exposure. The database port is not publicly accessible.
Your client data is never used to train AI models.
Zero-training commitment
Your matter data, client information, uploaded documents, and AI query content are never used to train any AI model — including any third-party provider we use. We use Anthropic's API under zero-data-retention terms.
AI queries are processed via Anthropic's API under their zero-data-retention API agreement. Anthropic is contractually prohibited from using API input/output for model training.
AI conversations are stateless. No chat history is retained on third-party AI infrastructure between sessions.
Each AI request is scoped to the current matter's data only. The AI cannot access data from other matters or other firms.
We have a documented plan for identifying, containing, and notifying on security incidents.
System logs, error monitoring (Sentry), and alerting are active 24/7. Anomalous access patterns trigger automated alerts.
On confirmed breach: affected tenant access is isolated within 1 hour. The database row-level security layer limits blast radius to the affected tenant.
Affected firms are notified within 72 hours of a confirmed breach that affects their data, consistent with GDPR and applicable US state law notification requirements.
Every security incident is documented in a post-mortem report with root cause analysis, timeline, and remediation steps.
If you believe you have discovered a security vulnerability in Lexitio, please report it responsibly to security@lexitio.com. We will acknowledge your report within 2 business days, provide regular status updates, and work with you on responsible disclosure timing. We do not take legal action against researchers who follow responsible disclosure principles.
Our security controls are built to the SOC 2 Trust Service Criteria from day one. Formal SOC 2 Type I certification is targeted for Q3 2026, with Type II to follow after the required 6-month observation period.
Enterprise firms requiring a SOC 2 report or a security questionnaire prior to contracting should contact security@lexitio.com — we maintain a pre-certification security questionnaire and can provide a Business Associate Agreement on request.
Security issues
security@lexitio.comEnterprise / BAA requests
enterprise@lexitio.com