Lexarna handles privileged legal information, including material protected under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023, and matters under publication restrictions such as POCSO and the Juvenile Justice Act. This page describes the controls in place today. Where a control is still being built, we say so.

Encryption

Connections to Lexarna use TLS. Uploaded documents are stored in Amazon S3 encrypted at rest with AES-256 using AWS-managed keys. Database backups are kept for 7 days.

Where data is hosted

Uploaded documents, the application database and search indexes are hosted on AWS in Mumbai (ap-south-1). Some processing happens outside India: AI requests go to our model providers, and our sign-in, error monitoring, email and site analytics providers operate outside India. See the provider list below.

Keeping organisations separate

Matters, documents and search results are scoped to your organisation, and solo accounts get their own workspace. Access to a matter's documents is checked against matter membership on the server for every request. Automated tests cover these access checks.

Sign-in and access

Sign-in is handled by Clerk, and every API request carries a verified token. Firms control who can open, edit, download and share through roles and matter membership, and individual matters can be restricted to the people working on them.

AI providers

To answer questions, draft and analyse documents, Lexarna sends the relevant text (your question, passages from judgments and statutes, and, inside a matter, excerpts of its documents) to OpenAI and Anthropic through their APIs. Under their API terms, data sent this way is not used to train their models; providers may keep requests for a limited period for abuse monitoring. We don't train AI models on your content.

Sensitive matters

Matters involving POCSO, sexual offences, juveniles, matrimonial disputes, UAPA and similar categories are flagged from the matter's details, section citations and the opening pages of its documents. A flag is never lowered automatically. Nothing from a flagged matter is used to learn drafting preferences or kept in usage records.

Drafting preferences

If you turn on Remember how I draft, Lexarna turns your revision requests, edits and research answers into short style notes for your future drafts. It is off by default. ID numbers, phone numbers, email addresses and case and FIR numbers are masked before the text is analysed; names are not. Turn it off at any time, and review or delete what was learned in Settings.

Incident response

Our incident-response process covers reporting cybersecurity incidents to CERT-In within 6 hours, as the CERT-In Directions of 28 April 2022 require, and notifying personal-data breaches under the DPDP Act, 2023.

Service providers

AWS (Mumbai): hosting, database, document storage
OpenAI, Anthropic: AI models
Sarvam: speech-to-text when you dictate
Tavily: web search, only when a research or draft step uses the web
Clerk: sign-in
Razorpay: payments
Resend: email
Sentry, Vercel: error monitoring, site hosting and analytics

Your data

Export: download your details, matters, documents, research and drafting sessions and your activity as a ZIP file from Settings → Privacy.
Deletion: delete your account from Settings → Privacy. You are signed out straight away and we email you a link to cancel; your account and personal data are deleted after 7 days. Matters you share with colleagues stay with them. Payment records and GST invoices are kept as tax law requires.
We don't sell your data.

Certifications

Lexarna does not hold ISO 27001, SOC 2 or any other external security certification. We are designing our controls around the DPDP Act, 2023, the IT Act, 2000 and the CERT-In Directions, and we will take your procurement team through them.

Report a vulnerability

Write to tech@lexarna.com. We acknowledge reports within 48 hours. We don't offer a paid bug bounty yet, and with your permission we credit researchers when we publish a fix.

Security