Trust Center
LexSelect is the structured data layer for enterprise AI. This Trust Center summarizes how we protect customer data. Our SOC 2 Type 2 report and security policies are available upon request.
Learned Hand
PraxisFlow
- instaspace.ai
Pender Litigation
M Resolution
Product Security
We pay great attention to enterprise features such as access control and single sign on. We are happy to provide more details about our enterprise features upon request.
Data Security
Customer data is encrypted in transit and at rest and logically segregated between customer accounts. Encryption keys are managed and rotated, and customer data is securely deleted on request or when a customer relationship ends.
App Security
Security is built into our development life cycle through static code analysis, software composition analysis and secure coding training. Security issues are prioritized by severity and resolved within defined timeframes.
AI
We do not use data submitted through our API to train or improve AI models, and our sub-processors are configured not to either.
Data Privacy
We process personal data in line with our Privacy Policy and data processing agreements, use it only as those agreements permit, and maintain a record of processing activities and a designated data protection officer.
Access Control
Access to systems and customer data follows least privilege and need-to-know, using unique accounts and SSO. Access is provisioned through a formal approval process, reviewed periodically, and revoked promptly when personnel leave.
Infrastructure
LexSelect runs on Amazon Web Services. Customer data is hosted in the United States by default, and we can deploy in Canada, the United States or the European Union to meet jurisdictional requirements. Production uses load balancing, auto-scaling and redundant processing.
Endpoint Security
Company laptops are centrally managed, with full-disk encryption, anti-malware, automatic security updates, screen lock and a password manager.
Network Security
We protect our corporate network against external & internal threats.
Incident Response
We maintain a documented incident response plan and team, and test the plan annually. Security events are triaged, tracked and resolved, and affected customers are notified of breaches.
Risk Management
We run a formal risk assessment at least annually and track findings through to remediation. Vendors are assessed before onboarding and reviewed regularly.
BC/DR
We maintain business continuity and disaster recovery plans and test them annually. Databases are backed up daily, and backups are monitored and checked for integrity.
Training
All personnel complete security and privacy training at onboarding and annually, take part in phishing simulations, and acknowledge our security policies.
Change Management
All code changes are tracked in version control, then peer-reviewed, approved by someone other than the author, and tested before release. Development and test environments are kept separate from production.
Continuous Monitoring
Our security controls are monitored continuously through Drata. Logs are stored centrally, and audit trails cover privileged actions and access attempts.