LexAI Back to home

Security

Last updated: [LAST UPDATED DATE — TO BE SET AT PUBLICATION]

Draft — review required before public launch. This document is maintained by Digital Ways LLC and still contains placeholders in square brackets that must be validated by a qualified lawyer of the operating jurisdiction before production use.

This page is maintained by Digital Ways LLC, operator of the LexAI platform, to answer common security and privacy questions about LexAI. It describes controls currently enabled in the product and our operational approach. It is not an external certification and does not represent an audit report.

Shared responsibility

Security in LexAI is a shared responsibility. Digital Ways LLC operates the platform, its cloud infrastructure and its integrations. Customers (law firms) are responsible for managing their users, choosing what data to upload, keeping credentials secret and reviewing every AI-generated output before use.

Encryption

  • Transport: TLS 1.2 or higher for all traffic between your browser and our servers.
  • At rest: encryption applied by our cloud infrastructure to databases and object storage.
  • Secrets: API keys and service credentials are stored in encrypted vault storage, not in source code.

Access control

  • Authentication via email/password or supported OAuth providers.
  • Row-level security enforced at the database layer to isolate data per user and per firm.
  • Role-based access for administrative actions.
  • Least-privilege backend access: production data access is limited to a small number of engineers on a need-to-know basis and is logged.

AI data handling

  • Matter content is not used to train third-party foundation models.
  • Agent runs and results are logged inside your workspace and reviewable at any time.
  • Source-linked outputs and built-in verification checks. Every AI-generated output requires mandatory lawyer review before use.

Operational practices

  • Automatic dependency updates and security scanning.
  • Regular backups managed by the cloud provider.
  • Incident response: security events are triaged internally; affected customers are notified without undue delay in the event of a data breach involving their data.

Compliance status

Digital Ways LLC follows GDPR-aligned practices for the LexAI platform. Digital Ways LLC does not currently claim external certifications such as SOC 2, ISO 27001 or HIPAA. Any future certifications will be published on this page when obtained.

Data subject requests

See our Privacy Policy and Data Processing Agreement.