What we do with your documents, stated plainly
For most organisations, legal documents are the most confidential thing they hold. This page says what happens to them, what we are and are not certified for, and how to run LexCore so that nothing leaves your building.
Encryption
AES-256 at rest and TLS 1.3 in transit. Keys are managed per tenant, and document bodies are isolated from tenant metadata.
No training on your data
Your documents are never used to train or fine-tune any model, ours or a provider's. This is a contractual term in our Data Processing Addendum, not a toggle we could quietly change. One carve-out is stated there: a free-tier key you bring yourself is governed by that provider's own terms.
Sovereignty tier
Run the entire pipeline on models inside your environment. Documents are never transmitted. Air-gapped deployments are supported.
Three questions, three answers
"Is it sovereign?" is really three questions. The answers differ, a deployment can satisfy one without satisfying the others, and on hybrid the first two are answered per matter rather than per account.
| LexCore Cloud | LexCore Sovereign | Hybrid | |
|---|---|---|---|
| Where does your data rest? | In our managed environment in the European Union (France). | Wherever you put it: your data centre in Nigeria, or your own servers anywhere else. | Per matter. A matter on the quality tier rests where the cloud column says. A matter on the dedicated sovereign deployment rests where the sovereign column says. |
| Who reads the document text? | The AI provider named in our sub-processor register, under contract and with no training on your data. Today that provider is in the United States. | Nothing outside your deployment. The cloud lane is never built in the first place, and a request that asks for it is refused. | Whatever the matter's own tier says. Routing is set per matter and every review records its tier, so you can check the answer afterwards. |
| Where do our own logs go? | They may leave the deployment, redacted, so we can fix what breaks. | They stay inside, if you want them to. That is a separate switch from the one above. | One setting for the whole tenant, not per matter. Decide it once, based on the stricter of your two lanes. |
Which column you need usually comes down to one question. Does an obligation apply to you, such as sector regulation, a client mandate or a group policy, that fixes where a document may be processed? Bring that obligation to a scoping call and we will map it to a deployment shape.
What we claim, precisely
Legal AI gets sold with a lot of absolutes. Ours are written the way the product is built, so you can check each one.
Controls in place
In progress, and named as such
Send us your security questionnaire
We answer them in writing, before any commercial conversation. To report a vulnerability, email security@lexcore.ng.