Your legal data, under your absolute control
6 security commitments
Designed to uphold professional privilege and GDPR from day one.
We never train on your data
Your cases, documents and conversations are exclusively yours. They are never used to train AI models, neither ours nor anyone else's. Period.
Encryption in transit and of credentials
Communications use TLS (versions 1.2 and 1.3). Integration tokens and LexNET certificates are encrypted in the application with AES-256-GCM and database backups are encrypted before they are stored. We do not offer end-to-end encryption: the platform needs to read your documents to analyse them.
Storage in the European Union
Our infrastructure and database are in the EU (Hetzner, Germany). The AI models that process your queries and documents run on Google Cloud in the EU, and audio transcription runs on AssemblyAI in the EU, which deletes it as soon as we receive it. The only exception is the live voice in the mobile app (Hume AI, USA). The full list is in the privacy policy.
DPA compliant with GDPR Art. 28
We act as a Data Processor under GDPR Art. 28. We sign a Data Processing Agreement (DPA) with each law firm. Available on request.
Role-based access control
Each team member only accesses the cases assigned to them. Complete audit log of who accessed what and when.
Right to portability and erasure
You can export all your data at any time (JSON, PDF). You can request complete deletion of your account and data within 30 days.
Regulatory compliance
RGPD / GDPR
Regulation (EU) 2016/679
EU AI Act (RIA)
Regulation (EU) 2024/1689
Art. 28 RGPD
DPA available
CGAE White Paper
5 recommendations met
CGPJ Instruction 2/2026
Judicial AI regulation
DPIA GDPR Art. 35
Available on request
EU storage
Germany
Spanish Data Law
Organic Law 3/2018
What risks do we mitigate?
Client data breach
TLS-encrypted connection + role-based access.
AI training on your documents
Explicit contract: your data is NEVER used for training. Auditable.
Data outside the EU
Storage in the EU (Germany). AI providers are in the US: we anonymize personal data before sending them a query and apply Standard Contractual Clauses.
Attorney-client privilege violation
GDPR Art. 28 DPA. Lexiel acts under your instruction, not as independent third party.
Unable to recover data
Full export in JSON/PDF at any time. Portability guaranteed.
Hallucinations and fabricated citations
AI models can invent citations. Lexiel checks citations against official sources (BOE, CENDOJ and its corpus) and flags the ones it cannot confirm; final review remains with the lawyer.
Native GDPR compliance in all plans
There is no special security plan. Data protection is embedded in Lexiel's core. We sign the DPA with all clients at no extra cost.
Start free 14 daysSecurity FAQ
Does Lexiel access my clients' documents?
Lexiel processes documents you upload to provide the analysis you request. Documents are not stored longer than necessary for the task and are never shared with third parties or used for AI training.
Is attorney-client privilege protected?
Yes. We operate as a technology tool under your direction (GDPR Art. 28). Information shared with Lexiel is covered by the same duty of confidentiality as any other tool in your firm. The DPA ensures we are accountable for protecting that information.
Where are Lexiel's servers located?
We store your data in the European Union (Germany). To generate answers, queries are sent, with personal data anonymized, to AI providers in the US covered by Standard Contractual Clauses; the list is in the privacy policy.
Does Lexiel use my data to train its AI?
No. Never. Your cases, documents, invoices and conversations are yours and are never used to improve the AI model. Lexiel's model is trained exclusively on public legal sources: BOE, CENDOJ, Constitutional Court.
Can I request deletion of my data?
Yes, you have the right to erasure (GDPR Art. 17). Send an email to hola@lexiel.ai and we delete all your data within 30 days, with written confirmation.
Questions about security or need the DPA?
We can send you the DPA, processing activities register, and answer any questions from your DPO. Or just try Lexiel free for 14 days.