Security & Trust.

• Application: Vercel (US-region edge + serverless).
• Database + auth + object storage: Supabase (Pro plan, AWS us-east-1).
• Email: Resend (transactional only).
• Payments: Stripe (PCI-DSS Level 1).
• AI: Anthropic (primary — generative features) and OpenAI (text embeddings for search only — no generation and no audio; Lexboard does not transcribe call recordings) via their commercial APIs, which prohibit training on customer content; providers may retain API data for a limited period (typically up to 30 days) for abuse monitoring, then delete it. Firms may optionally connect their own Anthropic API key, in which case that firm’s data is processed under its own agreement with Anthropic.

The full list of subprocessors is at /legal/subprocessors.

• In transit: TLS 1.2+ on every connection. HSTS (1 year, includeSubDomains, preload) forces HTTPS at the browser level.
• At rest: AES-256 via Supabase (Postgres) and AWS S3 (object storage).
• Backups: daily encrypted database backups with 7-day retention. Continuous point-in-time recovery is not currently enabled, so the worst-case recovery point is up to 24 hours.
• Secrets: stored in Vercel environment variables; rotated upon any suspected exposure or personnel change.

• Tenant isolation: Row-Level Security (RLS) policies on every firm-scoped table, keyed to the authenticated user’s firm, plus application-layer re-validation of firm membership on every API request. Privileged (service-role) database access is confined to server-side code paths, is never exposed to browsers, and is reviewed as part of code review — we treat RLS as the second line of defense beneath application-level authorization.
• Authentication: Email + password with bcrypt hashing (Supabase Auth). Multi-factor authentication (TOTP) available on every account.
• Session management: 7-day rolling auth token, invalidated on password change, MFA enroll, or admin lockout.
• Per-user roles: admin / attorney / paralegal / case_manager / staff / read_only. Sensitive operations (finalize closing, fee splits, delete account) require admin or attorney role.
• Audit log: every mutating action recorded in public.audit_log; available to firm admins for review.

• Content-Security-Policy with per-request nonce — locks down which origins may load scripts, styles, fonts, etc. Defeats most XSS payloads at the browser level.
• HTTP headers: Strict-Transport-Security, X-Frame-Options SAMEORIGIN (with CSP frame-ancestors 'self'), X-Content-Type-Options nosniff, Referrer-Policy strict-origin, Permissions-Policy (deny camera/microphone/etc.; geolocation first-party only), Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.
• Rate limiting on authentication, AI, and template-generation endpoints to mitigate brute-force, scraping, and runaway cost.
• SQL: all queries via Supabase client; no string-concatenated SQL.
• File uploads: 25 MB cap per file; MIME-type scanning; per-firm storage path isolation.
• Webhook verification: Stripe, Supabase, and other inbound webhooks require valid signature with replay-window enforcement.

• Error monitoring: Sentry (all runtimes: browser, Node, Edge). Source maps uploaded server-side and deleted from public output; PII is scrubbed where feasible.
• Audit log: append-only, and enforced at the database rather than by convention — INSERT, UPDATE, DELETE and TRUNCATE are revoked from every signed-in role, so the people a row records cannot rewrite it; writes come only from server-side code and database triggers. Rows cover 100+ business-event types across case, client, document, financial, communication and permission data. Coverage is broad rather than total: caches, delivery queues, retry bookkeeping and per-user preferences are excluded on purpose. Money movements and external disclosures get richer overlay records per ABA Rules 1.15 and 1.6.
• Access logs: Vercel logs HTTP requests for 30 days; longer retention available on request.

• Recovery point (RPO): up to 24 hours. Our database is backed up daily; continuous point-in-time recovery is not enabled, so a bad day can cost up to a day of work.
• Recovery time (RTO): not yet measured. We will publish a number once a documented restore drill has produced one, and not before.
• Database: daily encrypted backups held by our hosting provider, 7-day retention.
• Object storage: S3-class durability (eleven 9's) against hardware loss. Durability is not a backup: it does not protect against our own bad delete, and document files do not yet have a second, independent copy.
• Drills: a documented backup-restore runbook exists; a full restore drill has not yet been performed. One is scheduled, and the measured elapsed time will be published here.

We maintain a documented incident-response plan with severity tiers (SEV1: outage / data loss, SEV2: degraded service, SEV3: isolated bug). For SEV1:

• Acknowledge within 5 minutes of first alert.
• Status update within 15 minutes; updates every 15 minutes thereafter.
• Customer notification within 60 minutes of any incident lasting more than one hour.
• Personal Data Breach notification without undue delay, and in any event within 72 hours after confirming a breach affecting customer data — in phases where investigation is ongoing.
• Post-mortem published within 5 business days.

• GDPR / UK GDPR: we act as Data Processor; the customer firm is Controller. Standard Contractual Clauses available on request.
• CCPA / CPRA: we act as Service Provider; we do not sell or share Personal Information.
• HIPAA: Lexboard is not a covered entity. In the typical personal-injury engagement, the customer firm obtains medical records under a HIPAA authorization (45 CFR §164.508) signed by its own client — no Business Associate Agreement is required for Lexboard to process them. We nonetheless apply safeguards consistent with the HIPAA Security Rule (encryption in transit and at rest, role-based access, audit logging). Lexboard does not currently offer a BAA; firms acting as a business associate of a covered entity must not upload PHI received in that capacity. Firms with BAA requirements should contact legal@lexboard.net to discuss enterprise options.
• SOC 2: not yet certified. Gap analysis in progress; targeting Type 1 within 12 months of first paid customer.
• ABA Model Rules: platform features designed to support compliance with Rules 1.1, 1.6, 1.15, 1.18, 5.3, and 7.1 — see /legal/bar-rules.

We accept good-faith security research reports at security@lexboard.net. We commit to acknowledging within 2 business days and providing status updates every 5 business days until resolution. We won't pursue legal action against researchers who follow our coordinated-disclosure guidelines (see AUP § 9).

• Lexboard is founder-operated. Production access is restricted to the founder, protected by MFA, and logged.
• Before any additional personnel receive production access, they will sign confidentiality agreements, undergo background screening, and complete security-awareness training.

We commit to an independent third-party penetration test before general availability and at least annually thereafter, plus ad-hoc testing after major architectural changes. Results will be shareable under NDA on request to security@lexboard.net.

This page is reviewed quarterly and updated when material changes occur. Customers are notified by email to designated firm administrators for any change to encryption, hosting region, or sub-processor list.