Built to hold client files, trust money, and medical records

Where your data lives

Hosting	Enterprise cloud infrastructure from a leading US provider, on the same healthcare-eligible foundation used by hospitals and insurers.
Recovery copies	Maintained in a geographically separate region, protected by their own encryption keys.
Data residency	Your documents, records, and backups are stored and processed in the United States only. Two services sit outside that boundary and never receive matter content: sign-in through your firm’s own Microsoft 365 tenant, which is processed wherever your tenant lives, and card payments, which are handled by our payment processor under its own agreements.
Physical security	Data centers operated by our cloud provider under the provider’s own independent audits; LexSense staff never handle hardware. Those audit reports are the provider’s, not ours, and are available to qualified prospects through our security package.

Isolation and encryption

Your firm’s data is separated from every other customer’s at the infrastructure level, not by a row in a shared table. Enterprise firms run in a dedicated private environment that no one else touches.

In transit	TLS 1.2 or higher on every connection: browser, Word add-in, desktop Companion, API, and the platform’s own connections to its database and storage. Unencrypted connections are refused.
At rest	AES-256 across documents, database, backups, and logs, with encryption keys dedicated to your firm.
Key custody	Keys are held in a hardened key-management service, cannot be exported, and every use is logged.
Uploads	Every file is screened for malware before it reaches a matter; unscanned files are not released to the matter. Anything flagged is quarantined and never previewed or shared.

Sign-in and session control

• Phishing-resistant sign-in. FIDO2 / WebAuthn hardware keys and built-in device authenticators as a second factor, alongside authenticator-app codes, with one-time recovery codes.
• Single sign-on. Microsoft 365 sign-in, so your firm’s own identity rules apply and account access is controlled instantly from one place.
• Matter screens (ethical walls). An administrator can wall a named person off a matter. The wall overrides role, seat, search, API, and AI paths; raising and lifting it are both recorded for the conflicts file.
• Session-based security. Administrators see every signed-in device at any moment and can end any session, revoke remembered logins, or block an account across web, desktop, and API in one click.
• Hardened accounts. Passwords are never stored in readable form, sessions expire on inactivity, and sign-in attempts are rate-limited and recorded.
• Support you can see. Screen sharing for help happens only with the user’s consent, is view-only, masks typed input, and keeps nothing afterwards.

Who sees what

• Roles you define. Build roles from granular rights, down to who may see billing rates, approve time, or move money in trust.
• Matter-level assignment. Whether someone can open a file is decided by their assignment to the matter, not by folder luck.
• Access review. A one-page view shows who holds each sensitive right today, so the firm can prove it, not assume it.
• Dual approval. Trust disbursements above a threshold the firm sets need a second approver before they post. This is a firm-configured control: it is off until your firm sets its threshold.
• Sharing you control. Client and outside-counsel links expire, can be password-protected, are revocable in one click, and record every open. There are no anonymous downloads.

Resilience and recovery

Documents	Every version of every document is kept and continuously replicated to a second region into immutable storage, immutable for the published retention window, so within that window a ransomware event or an administrator mistake cannot erase what was there.
Database	Continuous backups with point-in-time recovery, retained for weeks and copied to the second region.
Environments	Defined as code and rebuildable from scratch, with regular server snapshots.
Recovery objectives	Data loss measured in minutes, service restoration measured in hours, backed by a documented contingency plan. Specific commitments are set out in your service agreement.
Tested, not assumed	Restore exercises run on a schedule and every result is recorded: a full database is restored to a fresh instance, verified over an encrypted connection, and a document is read back from the second region. The most recent full restore completed in under fifteen minutes.
Deletion protection	Databases and document versions are protected against deletion by any application credential and against a single mistaken action. Changing that protection requires privileged account-level access, which is itself logged and alarmed.

Monitoring and audit

• Application audit log. Every security-relevant action by every person, in the application and through the API, is recorded with who, what, when, and from where, and is searchable by the firm’s administrators.
• Infrastructure audit log. Every change to the cloud environment is recorded independently of the application, written to tamper-resistant storage, and retained for the multi-year periods compliance frameworks expect.
• Continuous monitoring. Threat detection, configuration checks, and network monitoring run on the environment itself, and findings are triaged, not just collected.
• Someone is told. Every detector routes to a monitored security mailbox: threat findings, configuration drift, failed controls, service health, and spend. A monthly review of every control is recorded, and its exceptions are written down with dates.
• Operational access. Interactive host access is identity-bound, multi-factor, and transcribed. A hardware-keyed break-glass account exists and is not used for operations; its console use is CloudTrail-logged and alarmed.
• Patching. Application dependencies are reviewed and updated on a security cadence, with advisories tracked against every release.

AI governance

The AI features (intake, drafting, and conversational editing in Word) run inside LexSense’s own private cloud environment, using enterprise-grade foundation models under agreements that keep your data yours.

Where prompts go	Nowhere outside our environment. Prompts and documents are never sent to public AI services and are never used to train any model, ours or anyone else’s.
What it can read	Only what the person asking can already open. Retrieval is scoped to their matters and the firm’s library; access rules apply to the AI exactly as they apply to the user.
What it produces	Drafts and suggestions for a lawyer to review. Nothing is filed, sent, docketed, or billed by the AI without a person approving it.
Record	Every request is logged: who asked, on which matter, what it drew from, and what it produced.
Control	The firm chooses which AI tiers are available, can restrict premium tiers, and can switch AI off per user or for the whole firm.
Health information	Only models covered by our healthcare data agreements are offered. Anything outside that coverage is not enabled, however capable.

Medical records and HIPAA

Injury, malpractice, and workers’ compensation matters are full of health information, so LexSense is designed around HIPAA’s administrative, physical, and technical safeguards: encrypted storage on healthcare-eligible infrastructure, role-based access, complete audit trails, and written security policies. Our infrastructure is covered by a Business Associate Addendum, and we will sign a Business Associate Agreement with your firm that puts our responsibility in writing. We do not hold a HIPAA attestation and do not describe ourselves as certified.

Third parties

Very few third parties touch customer data, and each one sees only what its job requires: our cloud infrastructure provider (hosting, storage, backups, and AI model execution, US regions only), Microsoft for sign-in when the firm enables single sign-on, a payments processor for client portal payments (card details never touch LexSense), and an email delivery service for notifications. The complete list, with what each receives, is provided to qualified prospects and updated before any change.

Ownership and exit

• Your data is yours. Documents, matters, time, invoices, and trust records belong to the firm. We act only as a processor and never mine, sell, or train on them.
• Export on request. Documents leave in their native formats with folder structure intact; records export in the standard formats named in your agreement. We run the export and deliver it, at no charge and without conditions.
• When you leave. We hand over a complete export, then retire the environment and its encryption keys on a documented schedule, and confirm it in writing.

Detailed documentation for your review

We don’t lead with badges. What we provide is a written description of every control, a customer agreement and Business Associate Agreement signed at contracting that make it binding, and complete answers to your security questionnaire. Those customer terms and the BAA are provided at contracting; the terms and privacy notice published on this website are drafts pending attorney review. Qualified prospects receive, under a confidentiality agreement: the detailed architecture and data-flow diagrams, our written security policies (fourteen, from access control and change management to incident response and vendor management, marked as drafts until adoption is complete), control descriptions mapped criterion by criterion to the SOC 2 Trust Services Criteria, the risk and vendor registers, the subprocessor list, the contingency plan with restore-exercise records, and a working session with the engineer who built the environment.

Reporting a security concern. If you believe you have found a vulnerability in LexSense, email security@lexsense.ai. We acknowledge within two business days, keep you informed while we investigate, and never take action against good-faith research.