Security and privacy

Client documents, treated like client documents.

LexForge handles legal documents. This page sets out where your files are stored, what processes them, and what your firm controls.

UK document storage & OCREEA-only structure analysisNever used to train AI

Document controls

How LexForge handles your documents.

01

Data residency & retention

Your documents and the reading of them (OCR) stay in Microsoft Azure UK South. Structure and layout analysis runs in the Azure OpenAI EU Data Zone within the EEA.

Each workspace chooses how long converted outputs are kept: seven days by default, up to 30 days. They are then deleted automatically.

02

Wording and training

LexForge does not use customer documents to train any AI model.

Every finished document is checked against the words read from the source. Anything the check cannot confirm is flagged for a person to read.

03

Automatic scan cleanup

Your source scan goes on the short-retention path the moment it arrives, then leaves active storage automatically.

Document text never reaches our logs.

04

Retention your firm controls

Your workspace sets how long finished files stay available, from seven to 30 days. Source scans always follow the shorter path.

Billing, email and support details sit with the sub-processors listed below.

Technical detail: what runs where, and for how long

Azure OpenAI receives relevant full-page images and extracted text for structure and layout analysis in the EU Data Zone. Requests use storage disabled (store=false), so normal Responses API conversation state is not retained. Customer material is not used to train generative models. Microsoft performs automated abuse monitoring. Material flagged by the abuse-monitoring system, or identified as part of a potentially abusive pattern of use, may be stored in a Microsoft-controlled abuse-monitoring store and reviewed by authorised Microsoft staff. Documents and OCR remain in UK South.

Uploaded scans are scheduled for deletion from active storage two hours after upload. Azure Storage lifecycle rules make overdue source and standard extracted-text cache blobs eligible for deletion once they are more than one day old. Microsoft controls the exact lifecycle processing time. Deleted blobs may remain recoverable to authorised administrators for up to seven days under Azure soft delete.

Two conversion paths use AI differently. On Reconstruct, the standard path, Azure Document Intelligence OCR supplies every word and AI decides structure and layout only. On Restyle, an experimental path a workspace chooses deliberately, an AI model transcribes the words directly from full-page images, including handwriting, and a second focused AI call may propose a correction to an individual disputed span. A correction is kept only when it exactly matches the independent OCR reading. Every Restyle draft is held for human review rather than released as accepted.

During house-style setup, AI may suggest labels for a firm's own Word styles using style names and formatting only, never document content. A suggestion takes effect only after a person confirms it.

The full policy is in our privacy policy.

Illustrative change report

What the wording check proves.

Every conversion records the wording check and flags uncertain words. The example below is invented, but the layout is what your team sees.

Change reportExample document · 14 pages
Ready for review
Pages checked
14 / 14
Words compared
9,412
Words flagged for review
3
Wording check
Matched
Flagged words still need a person to check them.

Data flow

The path of a document

01

Upload

Your file arrives in LexForge.

UK
02

Read

Azure Document Intelligence reads the words.

UK
03

Understand structure

AI works out headings, numbering and layout. On the experimental Restyle path it also transcribes the words, checked against the OCR reading.

EU Data Zone · EEA
04

Return and retain

You get an editable Word file. Your workspace decides how long it stays.

UK-hosted service

Due diligence

Sub-processors

These are the companies that process data for LexForge. Documents and OCR stay in Microsoft Azure UK South. Structure and layout analysis runs in the Azure OpenAI EU Data Zone within the EEA.

ProcessorPurposeRegion
Microsoft AzureHosting, storage, database, Document Intelligence OCR and document-processing servicesUK South for document storage, database and OCR
Azure OpenAI ServiceStructure and layout analysis from page images and extracted text. On the experimental Restyle path it also transcribes wording, checked against the independent OCR reading. Storage-disabled requests; Microsoft abuse monitoring applies, as set out above.EU Data Zone within the EEA. No United States transfer on this path, so standard contractual clauses (SCCs) are not needed for it
StripePayment processing and billingEU/UK
MailjetTransactional email deliveryEU
ClerkSign-in and user accounts (names, work emails)EU
SentryBrowser error monitoring for product pages; no document text, filenames, email addresses, job IDs or tenant IDsEU
PostHogCookieless product analytics for coarse page and feature usage; no document text, filenames, email addresses, job IDs or tenant IDsEU

Security questionnaires

Need help with a data protection impact assessment (DPIA) or security questionnaire?

Send yours over, or ask for our security pack, and we will reply with the documents you need.

Prefer email? support@lexforge.app
Typical response within two working days.

Do not paste document text here. If we need to see a file, we will arrange a secure transfer.

We use these details only to respond.

Request received.

Thanks. We will be in touch, usually within two working days.

Security review

Questions about security?

Start your free pilot →