Data privacy and the no-training policy
Your documents are never used to train public models, and Nigerian data-protection handling under the Nigeria Data Protection Act (NDPA) 2023 is built into the platform.
- No-training policy. Your uploaded agreements, review outputs and playbook rules are never used to train public LLM models. On the cloud tier, model context is used only to process your request and is not retained for training. The sovereignty tier keeps everything on local models.
- Nigerian data-protection handling. LexCore is designed around the Nigeria Data Protection Act (NDPA) 2023, the primary statute, supervised by the NDPC. The earlier NDPR 2019 is still relevant as a subsidiary instrument. In practice that means access controls, data-residency options, and simple deletion on request. Formal certification is on the roadmap and is not claimed as complete.
- PII redaction in logs. Emails and long digit runs are masked before text reaches a log sink, as defence in depth for privileged data.
- No-store free scan. The public scanner does not retain the document you test with.
Trust
For the strongest guarantee, a self-hosted sovereign deployment runs the whole stack on your own infrastructure, so document bytes and model calls stay inside your network boundary. On LexCore-hosted plans the sovereignty tier keeps model inference local; storage remains on LexCore-operated infrastructure.
Related documentation
Security architecture: isolation, encryption and access
Tenant isolation enforced in both the app and the database, AES-256 encryption with keys sourced from a KMS, and access gated by role and MFA.
Your data controls: export, deletion and MFA
The controls a data-privacy review expects to find: version history, export, permanent erasure, account purge and step-up MFA.
Data sovereignty and model routing
How the model router keeps a sovereign tenant's documents away from third-party model providers, and why where your analytics go is a separate question with its own control.