§ Security Defence in depth, not compliance theatre trust.lexlegis.ai

Built for matters that cannot leak.

Security is not a deployment flag or a checkbox exercise. It is architecture, certifications, defence in depth, and responsible disclosure discipline. Everything below is audited. Everything below is live.

§ 01 • Certifications

Eight frameworks, continuously audited.

International and Indian security, privacy and AI governance frameworks. Annual audit where applicable, continuous posture management always.

ISO 27001:2022

Information security management. Certified across operations. Annual surveillance audits.

ISO 27701

Privacy information management. In audit for Q3 2026 certification.

SOC 2 Type II

Trust services criteria audit. Window active, report expected Q3 2026.

DPDP Act 2023

Full alignment with India Digital Personal Data Protection Act 2023 and rules thereunder.

GDPR

General Data Protection Regulation. EU representative appointed. Adequacy maintained.

CERT-In

Audited by CERT-In empaneled security auditors. Incident reporting protocols in place.

NIST AI RMF

AI Risk Management Framework. Internal compliance posture mapped across Govern, Map, Measure, Manage.

FIPS 140-3

Candidate status for Mode D, DGX Spark cryptographic module certification.

§ 02 • Defence In Depth

Four layers. One posture.

Every input and every output passes through all four layers. Failure of any layer opens a ticket, not a breach.

Data Layer

  • TLS 1.3 in transit, AES 256 at rest
  • Customer managed keys (BYOK) on Modes C, D, E
  • Hardware Security Modules (HSM) for key storage
  • Zero customer content in shared training
  • Matter level isolation on multi tenant SaaS

Identity Layer

  • SAML 2.0, OIDC, SCIM 2.0 provisioning
  • SSO required on all Enterprise deployments
  • Role Based Access Control with custom roles
  • MFA enforced via customer IdP policies
  • Session recording and replay on Enterprise

Network Layer

  • VPC isolation on Modes B and C
  • Private Link and Private Service Connect
  • Web Application Firewall, DDoS protection
  • IP allow listing and geo restrictions
  • No inbound traffic on Mode D and E

Model Layer

  • Prompt injection detection and sanitisation
  • Output hallucination detection, meta reasoning gate
  • Custom guardrails per tenant
  • Model poisoning defence via signed checkpoints
  • Inference audit trail, every call logged and attributable
§ 03 • Data Handling

Your data stays yours.

Five commitments that govern how customer content moves through Lexlegis.ai. These are contractual, not aspirational.

No training on your data.

Your uploaded documents, queries and outputs never enter training corpora for shared models. Fine tuning on your data, if offered, happens only under a signed DPA and only inside your deployment boundary.

Data residency by design.

Mode A data is in India. Mode B is on L&T Vyoma sovereign cloud. Mode C is in your chosen region. Modes D and E are on your premises. Residency is architecture, not a flag.

Minimum retention.

We retain customer content only as long as required to service the account. Retention windows are configurable to zero on Enterprise and on Modes D, E.

Portable on exit.

All customer data is exportable at any time in standard formats. On termination, data is returned or destroyed at customer election, with attestation.

§ 04 • Responsible Disclosure

Found something? Please tell us.

We operate a coordinated disclosure programme for security researchers. Acknowledgement within 24 hours, triage within 72, fix or mitigation within defined SLAs by severity.

How to report

security@lexlegis.ai

Include steps to reproduce, affected component, and your preferred credit (if any). PGP key available on request. We do not pursue researchers acting in good faith.

Our commitments

Acknowledgement, remediation, credit

We acknowledge within 24 hours, triage within 72, and close or mitigate per severity SLAs. Credit is public in our security advisories where researchers permit.

Start today

Legal AID is live. MIRA is open.

Start a free trial of Ask, Interact and Draft, no credit card required. MIRA early access is open now, request a slot and a specialist will reach out within one working day.