How your documents are protected

In transit and at rest

Connections to LexSalim use TLS. Documents are encrypted at rest with keys managed by the service. Documents are not end-to-end encrypted: the service decrypts them to extract text and to run the analysis you request. If you need a document never to be readable by the service, do not upload it.

On arrival

Every file is scanned for malware before it is stored. Files that fail the scan are rejected. Text extraction runs inside the service; nothing is sent to an AI model at upload.

Access

• Access is granted per case. Being in an organisation does not grant access to its cases, and administrators do not automatically see case content.
• Sign-in is passwordless with a one-time email code, and organisations can require an authenticator app.
• Sensitive actions require a fresh authenticator check.

Audit trail

Every upload, view, download, agent run, finding review, status change, member change and billing change is recorded with the user and the time. The trail cannot be edited and is available to the organisation.

AI providers

When you ask the Case Agent for analysis, the relevant content is sent to AI model providers under contracts that prohibit using it to train models and that limit retention. Providers and their locations will be listed in the sub-processor register before real customer data is accepted. See What the AI can and cannot see.

Hosting and transfers

Data is hosted in the European Economic Area. Where a sub-processor processes data outside the UK or EEA, transfers rely on adequacy decisions or standard contractual clauses with supplementary measures. The privacy notice (draft) linked in the footer describes this and will be finalised before paid plans open.

Retention and deletion

Documents are kept while a case is open or archived and deleted after export at closure, subject to legal holds. Account data is kept while the account is open and for a limited period afterwards. Exact periods are stated in the privacy notice.

No certification claimed

LexSalim does not currently claim any external security certification. Controls are described plainly so you can assess them; nothing is implied beyond what is written here.