Security we can demonstrate.
Certified, externally audited and transparently documented. Here we show how Lextract protects, processes and controls client data.
No training on client data.
Processed separately
Lextract does not use client data to train models. Every data room is processed separately for each client, and anything generated in one matter is not reused for another.
Configuration to your standards
You store your templates, settings and review logic as configuration. Lextract then works to your standards without models learning from your data.
Built around the requirements of professional conduct.
Contractually, technically and organisationally, Lextract is aligned with professional conduct requirements concerning confidentiality, use of service providers and access control — among other things through provider agreements, contractual confidentiality obligations and traceable processing.
Data lifecycle, from import to deletion.
Intake
Documents are uploaded directly or imported from connected systems.
Processing
Lextract extracts, structures and analyses content to produce findings, references and draft reports.
Separation
Client data is logically separated during processing and made available only to authorised users.
Security
Access is role-based and restricted according to the principle of least privilege; authentication is handled through Auth0 with MFA.
Deletion
Data is removed at the end of the project or at the client’s request, in accordance with the agreed deletion processes.
Data protection and security at a glance.
What security officers ask most often.
Is Lextract GDPR-compliant?+
Is there a BRAO certification?+
What happens to the data when the project ends?+
The documents we provide.
Firms assess the use of service providers against their own standards.
- ISO/IEC 27001 certificate
- Data processing agreement with technical and organisational measures
- List of sub-processors
- Report on the most recent penetration test
- Deletion policy