Your clients trust you.
We take that seriously.
LexMotus is built for firms handling sensitive client data every day. Here's exactly what we do — and don't do — to protect it.Decision support, not decision execution: we secure the platform that watches deadlines and surfaces guidance — attorneys remain responsible for legal judgment and filings.
2021 standard
2023 standard
actively improving
Access Control & Tenant Isolation
Every firm on LexMotus gets a completely isolated data environment. Your matters, clients, documents, and communications are never mixed with another firm's data — not in the database, not in the application layer.
60+ granular permissions mapped to roles you define. An intake coordinator can create matters without touching billing. A paralegal can review a file without being able to delete it. Access is explicit, not assumed.
Database-level tenant isolation using PostgreSQL Row Level Security. Even if application code had a bug, a query cannot return another firm’s records — the database enforces it.
Short-lived JWT access tokens paired with rotating opaque refresh tokens stored in the database. Optional TOTP two-factor authentication for every user. Password changes revoke all existing sessions. No permanent API keys floating around.
Microsoft 365 and Google Workspace OIDC sign-in with JWKS signature verification, JIT user provisioning, and IdP group-to-role mapping. SSO sessions honor your identity provider's MFA — no separate LexMotus TOTP layer on top.
Over 80 action types — matter updates, document access, permission changes, settlement events, SSO logins, trust transactions, AI usage — are recorded with user, timestamp, IP, and context, and surfaced in an admin audit view.
Technical note — authentication & data model (for IT / security reviewers)
Firm identities, roles, and fine-grained permissions live in a dedicated PostgreSQL auth schema and are enforced on every request together with tenant isolation. Browser sessions use HttpOnly cookies: a short-lived access JWT paired with a rotating opaque refresh token stored in the database (not a long-lived API key model). Optional TOTP second factor is available for password-based users. Microsoft 365 and Google Workspace OIDC sign-in is supported with JIT user provisioning and configurable IdP group-to-role mapping — SSO users inherit their IdP's MFA posture. All auth paths enforce the same permission and tenant boundaries. For deeper assurance work, we can share architecture diagrams and policy mappings under NDA.
Data Protection & Encryption
Client data is encrypted in transit and at rest. We use AWS infrastructure with enterprise-grade storage and database services — the same ones used by banks, hospital systems, and federal agencies.
All communication between your browser and LexMotus uses TLS 1.2 or higher. Database connections verify certificate authority, not just encrypt opportunistically.
Documents in AWS S3 with server-side AES-256 encryption and a policy that rejects any upload without encryption. Database runs on AWS Aurora PostgreSQL with storage-layer encryption enabled.
Our Data Management Policy classifies data into Confidential (client PII, matter details), Restricted (operational data), and Public (marketing materials). Confidential data gets the strictest handling, owners, and controls.
We do not sell your data or your clients’ data. LexMotus does not use firm or client personal information—or your broader matter content—to train or fine-tune foundation models (whether hosted by us or a vendor). AI runs at inference only: each request uses the minimum context needed for that operation, tenant-scoped; we do not repurpose that content to train third-party models. Retrieval-augmented answers are grounded in your firm’s own documents within your tenant.
Application Security
We test LexMotus against the OWASP Top 10 (the industry standard checklist of web application vulnerabilities) and the OWASP API Top 10. Our current composite score is 72.0 / 100 — Grade B. That's solid for an early-stage platform, and we're actively working toward an A.
Parameterized queries throughout the application. User input is never concatenated directly into SQL, and UUIDs on URL parameters are validated before any database call.
Bcrypt password hashing (cost 12), progressive rate limiting on login, password reset, and TOTP verification, optional TOTP 2FA with forced enrollment available for firms that require it, Microsoft 365 and Google Workspace SSO with OIDC verification, and cryptographically-signed session cookies with HttpOnly, Secure, and SameSite flags.
We follow a written Secure Development Policy aligned with OWASP Secure-by-Design principles. Every code change is reviewed against the same checklist we use to score ourselves.
All API endpoints require authentication and enforce tenant context on every request — not just at login. Authentication endpoints and public-facing forms are protected by shared, multi-instance-safe rate limits with progressive lockout; coverage continues to expand across the rest of the API surface.
Incident Response
If something goes wrong, we have a plan — written down, not improvised. We maintain two formal incident response playbooks:
Each plan defines who owns the response, what steps to take in what order, how affected customers are notified, and how we recover. In the event of a confirmed data breach affecting your firm, we will notify you promptly with the specifics of what happened, what data was involved, and what we've done to contain it.
Availability & Business Continuity
We run on AWS infrastructure with automated backups and redundancy built in. Our Business Continuity and Disaster Recovery policy defines recovery objectives and procedures so that a hardware failure or infrastructure event doesn't mean your firm loses access to its files.
Aurora PostgreSQL automated backups with point-in-time recovery. Your data is backed up continuously, not just nightly.
AWS S3 stores documents with 99.999999999% (eleven nines) durability by automatically replicating data across multiple availability zones.
Our documented BC/DR policy sets defined recovery time and recovery point objectives — not a vague promise to “restore as quickly as possible.”
Security Policies
We operate with a documented security policy framework. These aren't checkbox documents — they define what we actually do, who's responsible, and how we handle exceptions.
Regulatory Compliance
LexMotus is built for organizations that handle sensitive health, disability, and educational records. We maintain the technical, administrative, and physical safeguards required by federal privacy regulations.
BAA available for signing. PHI access logging, encryption at rest and in transit, immutable audit trail, RBAC with minimum-necessary enforcement, automatic session timeout, breach notification tracking, and annual risk assessment — all implemented.
FERPA compliance addendum extends BAA coverage to educational records (IEPs, Section 504 plans, educational assessments). Same technical safeguards as HIPAA applied to all educational data. Document-level tagging for FERPA-protected records.
Compliance & Certification Roadmap
We believe in being honest about where we are. LexMotus is an early-stage platform. We don't have SOC 2 certification yet — but we're building toward it methodically, not just checking boxes.
Security policy framework established
CompleteSeven formal policies and incident response plans written and in effect. Data classification, access control, and secure development standards documented.
OWASP assessment completed
CompleteScored against OWASP Top 10 (2021) and OWASP API Top 10 (2023). Composite Grade B. Active remediation underway on the highest-leverage items.
HIPAA compliant — Business Associate ready
CompleteBAA template available. HIPAA Security and Privacy policies documented. Risk assessment completed. PHI access logging, encryption at rest and in transit, immutable audit trail, role-based access controls, automatic session timeout, and breach notification tracking all implemented.
FERPA compliant
CompleteFERPA compliance addendum extends BAA coverage to educational records. Same technical safeguards as HIPAA — encryption, access controls, audit logging, and data retention — applied to IEPs, 504 plans, and other educational records.
SOC 2 Type 1
PlannedSOC 2 Type 1 audit is on our roadmap and will be initiated when revenue supports the investment. Type 1 verifies that our security controls are designed correctly as of a point in time.
SOC 2 Type 2
PlannedApproximately six months after Type 1, we’ll pursue Type 2 — which tests that those controls operated effectively over time. Type 2 is the gold standard, and it’s our target.
CCPA data retention policy (public)
PlannedA public-facing data retention schedule for California clients, covering how long we retain different categories of data and how deletion requests are handled.
Have a security question?
We respond to all security inquiries directly — not through a ticketing system. If you have a question about our security practices, want to report a vulnerability, or need to discuss data handling specifics before signing on, reach out.