A+ Security Rating

Your information, locked down.

End-to-end encryption, a zero-knowledge architecture and automatic deletion of your documents. Every layer is designed to keep your information protected at all times.

Scroll

256-bit

AES encryption at rest

TLS 1.3

Transit protocol

0

Human access to your contracts

0 h

Original file retention

—  Encryption  —

End-to-end encryption

Your contracts travel and are stored protected by the highest industry standards.

Encryption in transit

All traffic between your device and LexyAi is protected with TLS 1.3, HTTPS enforced via HSTS and SHA-256 certificates.

TLS 1.3HTTPSHSTSSHA-256

Encryption at rest

All stored data is encrypted at rest with AES-256, one of the strongest encryption standards available.

AES-256At restSolid standard

Zero-Knowledge Architecture

Documents are processed in memory during analysis and are never indexed or stored in plain text permanently.

In memoryNo indexingNo plaintext

—  Infrastructure  —

Defense in depth

Multiple independent layers of protection, so no single weak point can expose your information.

Per-user isolation

Row-Level Security at the database level: every record is tied to your account and inaccessible to any other user.

File validation

We verify the real type of every file by its magic bytes —not its extension— and sanitize the filename before processing it.

Rate limiting

Protection against abuse and brute force with per-user and per-IP request limits on every sensitive endpoint.

Input validation

Every piece of data going in and out is validated against strict schemas to neutralize injections and malicious input.

Secure authentication

Every session is validated on the server and access to your contracts requires secure authentication: only you can get into your account.

Attack mitigation

Web application firewall and automatic mitigation of denial-of-service (DDoS) attacks at the edge.

—  Protection  —

Extra layers of protection

Additional measures that protect your account, your payments and every analysis you run.

Protected payments

Payments are processed securely through Stripe. We never store or have access to your card details.

Anti-injection protection

Your contract's text is processed in isolation and every analysis is validated before it's shown to you, preventing content manipulation.

Continuous monitoring

We continuously monitor the platform to detect and respond to any suspicious activity that could affect your information.

Least privilege

Each part of the service accesses only what is strictly necessary to function, protecting your information.

—  Artificial Intelligence  —

Your contract never trains any AI

We process your contract with cutting-edge AI in an isolated, ephemeral way, so your data is never used outside your analysis.

No reuse

Your contract's content is used solely to generate your analysis and never for any other purpose.

No training

The AI provider we use does not employ your content to train, fine-tune or improve its models.

Full isolation

Each analysis is completely independent. There is no shared context between different users or between sessions.

What happens to your contract?

1

You upload your contract

2

It travels encrypted

3

AI analyses it

4

You get your report

5

Your data is deleted

—  Retention  —

Your data lives the minimum necessary time

Every piece of data has a purpose and an expiry. When it is no longer needed, it is deleted.

File upload

Your contract travels encrypted with TLS 1.3. The filename is automatically sanitized before any processing.

In-memory extraction

Text is extracted directly into RAM. The original file is never written to permanent disk during the process.

Isolated analysis

The text is sent to the AI model in an ephemeral, isolated session. It is neither reused nor retained by the provider.

Only the analysis persists

Only the structured report is stored encrypted. The extracted text of the contract is not stored permanently.

Auto-deletion (< 5 min)

The original file is deleted from servers immediately upon completing the analysis, in less than 5 minutes.

Text purge (< 2 hours)

If extracted text persists temporarily, it is automatically purged within a maximum of 2 hours.

Full user control

You can delete any analysis at any time. Account deletion erases all your data in cascade, irreversibly.

—  Privacy  —

Your privacy, in your hands

Designed so you always have full control over your contracts and your information.

Your contracts, yours alone

Only you can access your analyses. Neither other users nor the LexyAi team can see your contract history.

We never sell your data

Your information is not shared with third parties or used for advertising purposes. Your privacy is not the product.

Delete everything, anytime

Delete any analysis or your entire account at any time from settings. Deletion is executed immediately and irreversibly.

You decide what you share

Generated reports are private by default. They are only shared if you explicitly choose to do so.

—  Commitments  —

What we promise about your data

Six privacy commitments that apply to every analysis you run on LexyAi, no exceptions.

lexyai.app — privacy audit
✓ OK

$ lexyai --privacy-audit --verbose

Original files (PDF / DOCX / TXT):deleted right after analysis
Extracted contract text:wiped from servers in < 2 hours
AI model training:never — the AI provider does not train on your data
Data sold to third parties:never, under any circumstance
Subscription cancellation:immediate, no lock-in, no questions
Full account deletion:complete wipe in < 24 hours
All 6 privacy commitments verified — Always active on your account

—  Frequently asked questions  —

Security questions

Start analyzing your contracts knowing your data is protected by the same level of security used by the most demanding companies.

Security | LexyAi