Indian lawyers handle some of the most sensitive material in any industry — client privilege, ongoing litigation, sealed proceedings, commercially-confidential transaction documents. The default posture has to be conservative. The system has to make the conservative default the easiest default.

This page consolidates how Lexarna handles data, what controls you have, and where to find the formal documents.

What we do

Consent shown up front (DPDP §6)

After first sign-in, every user sees their data-use settings and current values before continuing, and can change them in Settings → Privacy at any time.

Data-use settings

Settings → Privacy has two settings. Improve search keeps a record of your research questions, the results you open and your ratings to improve ranking; it is on by default. Remember how I draft learns style notes from your edits; it is off by default. Nothing is recorded or learned from flagged sensitive matters.

Deletion

Delete your account from Settings. You are signed out at once and emailed a cancel link; deletion runs after 7 days. Payment records and GST invoices are kept as tax law requires.

Export

Download your details, matters, documents, research and drafting sessions and your activity as JSON in a ZIP file from Settings → Privacy.

Encryption

Connections use TLS. Uploaded documents are encrypted at rest in Amazon S3 with AES-256 using AWS-managed keys.

Where data is hosted

Uploaded documents, the application database and search indexes are hosted on AWS in Mumbai. AI requests and some service providers (sign-in, error monitoring, email, site analytics) operate outside India.

No training on your content

We don't train AI models on your documents, drafts or questions. Our AI providers, OpenAI and Anthropic, don't use data sent through their APIs to train their models.

Activity record

Document views and downloads, changes to matters and documents, and changes to people and roles are recorded with who did it and when. Firm admins can review and export the record.

What we don't claim

We don't hold ISO 27001, SOC 2 or any external security certification. This page lists only controls that are in place today. If your procurement follows a specific framework, we'll go through it with you control by control.

Your rights at a glance

Access — see what we store about you and your matters.
Correction — fix anything inaccurate.
Erasure: delete your account from Settings, with 7 days to cancel.
Portability: download your data as a ZIP file from Settings.
Withdraw consent: turn either data-use setting off in Settings → Privacy at any time.
Grievance — escalate to our Grievance Officer (contact below).

What firm administrators control

Roles and permissions, including who can download and share documents.
Matter membership, and restricting a matter to the people working on it.
The firm's activity record, with filters and export.
Removing and suspending members.

Frequently asked

Is Lexarna built for the DPDP Act?

We are designing Lexarna around the DPDP Act, 2023: consent shown up front, data-use settings, export, deletion on request and a breach process. Our Privacy Policy and Terms set out the details.

Where is data stored?

Uploaded documents, the application database and search indexes are on AWS in Mumbai (ap-south-1). Backups are kept for 7 days.

Do you use third-party service providers?

Yes: AWS (hosting), OpenAI and Anthropic (AI models), Sarvam (speech-to-text), Tavily (web search when a step uses the web), Clerk (sign-in), Razorpay (payments), Resend (email), Sentry and Vercel (error monitoring, site hosting and analytics). Some of them operate outside India.

What do AI providers receive, and do they keep it?

The text needed for each request: your question, passages from judgments and statutes and, inside a matter, excerpts of its documents. Under their API terms, OpenAI and Anthropic don't use this data to train their models, and may keep requests for a limited period for abuse monitoring.

Does Lexarna learn from our drafts?

Only for users who turn on Remember how I draft, which is off by default. It keeps short style notes from their edits and revisions, with ID numbers, phone numbers, email addresses and case numbers masked first, and never learns from flagged sensitive matters. Notes can be reviewed and deleted in Settings.

How do you handle a data breach?

Our incident-response process covers containment, investigation, reporting cybersecurity incidents to CERT-In within 6 hours, and notifying affected users and the Data Protection Board under the DPDP Act.

Do you hold ISO 27001, SOC 2 or another certification?

No. We have not pursued external certification yet. We'll walk your procurement team through the controls that are in place today, and tell you plainly which are still being built.

Formal documents

Our Privacy Policy, Terms of Service, Security overview, and Sub-processor registry exist as separate documents and are linked from the footer once our legal review completes. In the meantime, if you need any of them under NDA for procurement review, write to tech@lexarna.com and we'll send the current drafts directly.

Get in touch

Compliance & procurement — tech@lexarna.com
Security disclosure — tech@lexarna.com
Grievance Officer — named contact provided on request to tech@lexarna.com; also published on the Privacy Policy page once it goes live.

See also about Lexarna and the feature surface for context on what we build and why.

Compliance & Security