Security Policy

1. Overview

Lex Protocol is built for legal professionals who handle sensitive client information. Security is foundational, not an afterthought. This policy describes the technical and organizational measures we implement to protect your data.

Company: Avci Technologies (ABN: 69688146581), Melbourne, VIC, Australia.

2. Encryption

At Rest

All note content, titles, and sensitive data are encrypted with AES-256-GCM (Galois/Counter Mode) with authenticated encryption. Each record uses a unique random 16-byte initialization vector (IV) and HMAC authentication tag. Encryption keys are 256-bit (32 bytes), managed via Google Cloud Secret Manager — never stored in source code or public repositories.

In Transit

All data is transmitted over TLS 1.2+ (HTTPS enforced on all endpoints). WebSocket connections for audio transcription also use secure WSS protocol.

Clio Integration

OAuth tokens are stored AES-256-GCM encrypted in Firestore. Tokens are decrypted only at the moment of use and never logged.

3. Authentication & Access Control

• Firebase Authentication (email/password)
• Two-Factor Authentication (2FA): TOTP-based with authenticator apps (Google Authenticator, Authy, etc.). Backup codes provided on setup.
• Biometric Authentication: Fingerprint and Face ID on mobile devices, with credentials stored in the device's Secure Store (not on our servers).

Session Management

• 12-hour session timeout (without biometric)
• 7-day session with biometric enabled
• 15-minute grace period for biometric re-authentication

Role-Based Access Control

Organization workspaces support Owner, Admin, and Member roles. Permissions are enforced at the database level via Firestore Security Rules. Administrative operations (role changes, data deletion) are restricted to Cloud Functions — no direct client-side writes to sensitive collections.

4. Infrastructure & Data Residency

• Cloud Provider: Google Cloud Platform (Firebase)
• Region: australia-southeast1 (Sydney, Australia)
• All Firestore data and Cloud Functions hosted in Australia

5. Third-Party Services

The following table summarizes the third-party services we use, what data they receive, and their data handling practices:

6. Input Validation & Application Security

• Schema Validation: All Cloud Function inputs validated with Zod schemas (field-level type checking, length limits, format validation).
• File Upload Restrictions: 10MB max for documents (PDF, DOCX, TXT), 5MB max for profile images. MIME type whitelist enforced at both client and server.
• HTML Sanitization: For third-party sync (Clio) — whitelist of allowed tags and attributes to prevent injection.
• OAuth CSRF Protection: Cryptographic state tokens with 10-minute TTL, single-use enforcement.
• Cross-Site Scripting (XSS): Output encoding applied in all server-rendered HTML (OAuth callback pages).
• CORS: Firebase ID token required on all API endpoints regardless of origin.

7. Rate Limiting

• Encryption/decryption operations: 60 requests per minute per user
• AI features (Ask Lexi): 10 requests per 2 minutes per user
• OAuth initiations: 20 per hour per user
• File uploads: 10 per hour per user

Implementation: Firestore-backed sliding windows with automatic TTL expiry.

8. Audio & Voice Data

• Voice recordings are processed in real-time via streaming transcription.
• No audio is stored on our servers — audio is streamed directly to Deepgram for transcription and immediately discarded.
• Voice Activity Detection (VAD) gates audio on-device before transmission, reducing unnecessary data transfer.
• Temporary Deepgram tokens are issued per-session (not full API keys).

9. Vulnerability Management

• High severity: Fix within 24 hours
• Medium severity: Fix within 7 days
• Low severity: Fix within 30 days

Report security issues to: security@lexprotocol.co

We use automated dependency scanning and keep all dependencies up to date.

10. Data Retention & Deletion

• Ask Lexi chat histories: Automatically deleted after 90 days of inactivity.
• Audio recordings: Never stored (streaming only).
• Account deletion: All user data permanently removed upon request, including encrypted notes, folders, and associated metadata. Clio tokens revoked and deleted.
• Soft-delete: 30-day recovery window for accidental deletions.

11. Monitoring & Incident Detection

• Error monitoring via Sentry with real-time alerting
• Discord webhook alerts for critical backend errors
• Firebase Cloud Logging for all Cloud Function executions
• Rate limit monitoring for abuse detection

See our Incident Response Plan at lex-protocol.com/incident-response.

12. Compliance

• Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth)
• Notifiable Data Breaches (NDB) scheme
• General Data Protection Regulation (GDPR) awareness for EU users
• Australian Consumer Law (ACL)

13. Contact