The LexAxiom Security Model

Built for the confidentiality law firms owe their clients. This is the security every firm gets at LexAxiom's general release. LexAxiom is currently in alpha and beta testing with a small group of firms under individual agreements.

• Private, completely closed AI. LexAxiom runs its AI on our own private servers. Your firm's data never goes to ChatGPT, Claude, Gemini, or any other outside AI company, and it is never used to train AI.
• Your keys, if you want them. Firms can bring and hold their own encryption keys, and revoke them at any time.
• No access without you. LexAxiom staff can see your data only inside a support session your firm opens. You see exactly what we access, every step is logged where you can review it, and the session ends when you end it.
• Your choice of data region.
• Your data stays yours. Export everything, every record and every document, at any time, with 90 days to take it if you ever leave.
• Independently audited. SOC 2 audit of our security controls.
• Encrypted everywhere. Data is encrypted in transit and at rest, with an extra layer for your firm's most sensitive fields.
• Your firm, walled off. Each firm's data is kept separate from every other firm's.
• Two-step sign-in for every administrator, and a tamper-evident audit log of security events.

Our AI

LexAxiom runs private, completely closed AI on our own private servers in Google Cloud in the United States. Only the LexAxiom app can reach them. LexAxiom does not use outside AI services such as ChatGPT, Claude, or Gemini, and your firm's data is never sent to OpenAI, Anthropic, Google's AI services, or any other AI company. If our AI is unavailable, the request waits or fails. It is never sent to an outside AI service as a backup. Our AI is never trained on your firm's data.

Where your data is

All firm data, including documents, call recordings, and AI processing, is stored and processed in Google Cloud in the United States. The companies that receive firm data are listed on our Subprocessors page.

AI history

What a user types into an AI feature is not saved after the answer is returned. Call transcripts and call analysis results are saved in the firm's own account, where firm users with access can open them.

People stay in control

LexAxiom does not answer phone calls, contact clients, or move cases on its own. Only a person moves a matter to a new stage. These things run in the background, and each can be stopped:

• Stalled alerts. LexAxiom checks every few minutes for leads that have not been followed up within the time the firm set for each stage, and shows an alert inside the app. The firm sets or changes those times.
• Follow-up tasks. Once an hour, LexAxiom creates tasks for staff about overdue payments and missing documents. It does not contact clients. A firm can ask us to switch this off.
• Scheduled report emails. Sent only on schedules a firm administrator creates, and stopped by deleting the schedule.
• Automation rules. Off for every firm unless the firm's administrator switches them on. They can send emails and notifications, create tasks, and update certain fields, and can be switched off at any time on the Automation Rules screen. They can never move a matter's stage or change who it is assigned to.
• Phone system. If a firm connects JustCall, a call from an unknown number creates a new matter in the firm's first stage. Disconnecting JustCall stops this.
• AI analysis runs only when a staff member starts it. A firm can ask us to switch off all AI features for the firm.

LexAxiom can also stop each of these for every firm at once.

Contact

Security questions: security@lexaxiom.com. To report a vulnerability, see our Vulnerability Disclosure Program. Privacy details are in our Privacy Policy.