Lexarna handles privileged legal information — including matters covered by attorney-client privilege under Section 132 of the Bharatiya Sakshya Adhiniyam, 2023, and matters subject to publication restrictions under POCSO §23, BNS §72, and the Juvenile Justice Act. The controls below describe what we do at every layer.

Encryption

AES-256 at rest, TLS 1.3 in transit. Every S3 upload requests explicit AES-256 server-side encryption per request — not just at the bucket-policy level. Database backups encrypted, retained 7 days.

Infrastructure & data residency

All persistent data — uploaded documents, primary database, vector embeddings — lives on Lexarna-managed AWS infrastructure in Mumbai (ap-south-1) and does not leave India. AI inference calls (query text, retrieved passages) reach US-hosted providers under DPAs with zero-data-retention headers. All-India deployment available for tier-1 enterprise.

Multi-layered tenant isolation

Every database query, vector lookup, knowledge-graph node, agent-memory entry, and S3 path is keyed to org_id and matter-membership. Solo users get per-user namespaces (personal_{user_id}) so two solo accounts cannot share storage. Canary-leak tests run on every PR.

Access control

Authentication via Clerk with JWT verification (RS256, JWKS cached). Matter-level RBAC: every document access goes through require_matter_access() checking MatterMember before allowing reads or writes.

AI & data transfer

Every outbound LLM call (OpenAI, Anthropic, Cohere) attaches an audit header asserting the contractual data-handling policy. Zero-data-retention agreements are negotiated and indicated by request-time flags. Documents are never used to train AI models — opt-in required for any training-data extraction; off by default.

Sensitive matter protections

POCSO, sexual offence (IPC §354/§376, BNS §63–§70), juvenile, UAPA, NSA and matrimonial matters are auto-classified on creation and upload. Protected matters bypass all training extraction and external quality evaluation; restricted matters additionally disable cross-matter graph queries.

Document handling

Uploaded files are stored in organisation-scoped S3 paths within an encrypted bucket — every upload is matter-scoped, never indexed alongside other tenants' content. Full erasure cascades across S3, Postgres, vector store, search index, knowledge graph, and agent memory.

Incident response

Cybersecurity incidents are reported to CERT-In within 6 hours of discovery as required by the CERT-In Direction dated 28 April 2022. Personal-data breaches notified to the Data Protection Board and affected users without undue delay under DPDP §8(6).

Privacy controls available to you

Granular consent — four toggles in Settings → Privacy control whether your data may be used for search-relevance improvement, draft training, playbook learning, or external AI-quality evaluation. All four are recorded with timestamps + IP for audit.
Data export — download every category of data we hold about you as a single ZIP archive. Available from Settings → Privacy.
Account deletion — triggers a cascade across every storage system within 30 days. Some categories (anonymised billing records for tax compliance, error events with redacted payloads) are retained as permitted by law.

Our commitments

Your documents are never used to train AI models without your explicit, separate, withdrawable consent
Your data is never sold to third parties
Tenant isolation is verified by automated CI tests on every change to the codebase
You can delete your account and all data at any time via Settings → Privacy or by emailing privacy@lexarna.com

Compliance posture

Lexarna is built to comply with the Digital Personal Data Protection Act 2023, the IT Act 2000, the Reasonable Security Practices Rules 2011 (which adopt IS/ISO/IEC 27001), and the CERT-In Directions of 28 April 2022. Our Record of Processing Activities (RoPA), Data Protection Impact Assessment (DPIA), and incident-response runbook are maintained internally and shared with enterprise customers under NDA on request. SOC 2 Type II is on the roadmap.

Report a vulnerability

Responsible disclosure to security@lexarna.com. We acknowledge within 48 hours and aim to remediate critical findings within 30 days. We do not yet offer a paid bug bounty; we credit researchers in our security advisories with permission.

Security