Per-tenant data isolation
Every firm's data is strictly isolated. No shared tables, no shared AI context. One tenant cannot read another's anything.
Security & trust
Security, by construction.
Lexivo is architected for the confidentiality, integrity, and auditability your practice demands. Real tenant isolation. Real encryption. Real audit logs. Not a compliance checkbox.
§I
Built on a privileged-by-default architecture
How the system is put together — the controls that don't require trusting us, they require checking us.
Encryption at rest and in transit
AES-256 for data at rest. TLS 1.3 in transit. Keys are rotated regularly and stored in a managed KMS.
Role-based access control
Granular roles for partners, senior lawyers, associates, paralegals, and accountants — enforced at the API layer, not just the UI.
Enforced MFA and session hygiene
Firms can require MFA for all users. Sessions are device-aware and can be revoked at any time.
§0The controls themselves
Every action, on the record.
Not a policy document — the screen an office admin actually opens. Who signed in, what they read, what they exported, and from where.
Role-based access
Office admin, accountant, lawyer, client — enforced on the server, not hidden with CSS on the screen.
Rates stay with finance
Lawyers see their work; they do not see rates, margins or firm revenue. That wall is built in, not a setting you must remember.
Client hard wall
A client account can reach exactly one thing: their own case. Every portal endpoint is checked against that, every time.
MFA & session control
Two-factor sign-in with a single active session, so a forgotten login on a shared machine does not stay open.
Immutable audit trail
Views, edits, exports, shares and sign-ins recorded with actor, time and address — written to be read back years later.
Encryption
Sensitive fields encrypted at rest, everything in transit over TLS, and backups encrypted the same way.
Consent & data export
Consent records and full data exports on request, so a privacy enquiry is a report, not a project.
In-region hosting
Keep the firm's data in the region you need it to sit in, on infrastructure you can point to in a tender.
§II
Aligned with the standards your clients expect
Lexivo is built against these control frameworks. Attestation is in progress; in-region hosting and bespoke DPAs are available to Enterprise tenants.
01
SOC 2 Type II
Controls aligned to Trust Services Criteria for security, availability, and confidentiality.
02
ISO 27001
Information security management aligned to ISO/IEC 27001.
03
GDPR
DPA available. Right-to-erasure, export, and audit tooling is built in.
04
HIPAA-ready controls
Encryption, access controls, and audit logging meet HIPAA technical safeguards for firms serving healthcare clients.
Frameworks listed reflect controls the platform is designed against. External attestation status is available on request.
§III
Every action, accounted for
An immutable audit log records every access, edit, share, and export across your firm. Search, filter, and export audit trails for compliance reviews or incident response.
- §III.aWho did what, when, and from which device
- §III.bExportable to CSV for legal hold or review
- §III.cRetained for the lifetime of your tenancy
§IV
Your data, your rules
Lexivo is a data processor for your firm. You decide what gets stored, who can access it, and when it leaves.
- §IV.aExport your entire firm's data at any time
- §IV.bDeletion on request, within contract terms
- §IV.cConfigurable retention per matter type
Security questions?
Our security team is happy to walk you through architecture, sub-processors, pen-test reports, and enterprise controls.