Security and Data Handling

This statement describes the technical and organisational measures that protect data in LexSalim. It is factual and avoids claims we cannot evidence: no certification (such as ISO 27001, SOC 2 or Cyber Essentials) is claimed, and no measure is described as in place unless it is built into the Service. It serves as Annex 2 to the Data Processing Agreement.

The Service runs on dedicated virtual servers in the European Union, behind a global edge network that terminates TLS, filters traffic and only forwards requests to the origin from its own network. Administrative access to servers is by SSH key only, root login is disabled, and the host firewall allows only web and administrative ports. Internal services (database, queue, document worker) are not reachable from the internet. Review: confirm the hosting provider and data-centre location statement for the sub-processor disclosure

Data in transit is encrypted with TLS. Documents and sensitive fields are encrypted at rest using envelope encryption: each document is encrypted with its own key, and those keys are encrypted with a master key held outside the database. Database storage is encrypted at the disk level by the hosting provider. Documents are not end-to-end encrypted: the Service decrypts them to process them. Review: confirm the provider’s disk-encryption statement and the key-management procedure, including rotation

Each organisation is a separate tenant. Access to a case is granted explicitly to named members; organisation membership alone does not open a case. Tenant isolation is enforced in the database with row-level security as well as in the application, and is covered by automated tests that attempt cross-tenant access. Platform administration is a separate, disabled-by-default surface that requires a platform role and a recent authenticator check.

Sign-in is passwordless: a one-time code is sent to the verified email address, stored only as a hash, valid for a short period, limited to a small number of attempts, and rotated on resend. Organisations can require an authenticator app (TOTP) as a second step, and sensitive actions (changing email, disabling two-factor, changing member roles, inviting administrators) require a fresh authenticator check. Rate limits apply per email address and per IP address, and unknown addresses receive the same response as known ones.

Uploads are limited by type and size, scanned for malware before they are stored, converted to searchable text by an isolated document worker, and encrypted as described above. Documents stay inside the case they were uploaded to. Downloads are logged.

Analysis runs only when a member requests it and only on the documents in that case. Requests, the documents used and the results are recorded in the audit trail. Model providers are engaged as sub-processors under contracts that prohibit training on Customer Content and limit retention; see the sub-processor disclosure.

Uploads, views, downloads, agent requests, approvals, membership changes and sign-in events are recorded with the acting user, time and action, and are visible to organisation administrators for their organisation. Audit records cannot be edited by users.

Database and document storage are backed up on a schedule to encrypted off-site storage with a rolling retention period. The backup procedure is in place; restoration testing is being verified before launch and its status will be stated here when complete. Review: backup restore test is not yet verified; do not approve this section until it is

Changes are made through version control and reviewed before release. Production secrets are held outside the repository and are never shared through chat or email. Dependencies are checked for known vulnerabilities before release. Logs are kept without query strings or document content and are retained for a short period.

Suspected security incidents should be reported to [email protected] with “Security” in the subject line, or by phone on +44 333 011 8207. We acknowledge reports promptly, investigate, contain, and notify affected customers without undue delay as set out in the DPA. Researchers who report vulnerabilities responsibly, without accessing other customers’ data or disrupting the Service, will not be pursued for doing so. Review: confirm the incident severity levels, notification targets and whether a dedicated security mailbox is created

Keep the mailbox used for sign-in secure, enable an authenticator app, invite only the people who need access to each case, remove members who leave, and do not place material in the Service that you are not permitted to process.