Frequently asked.

Lexlegis.ai is operated by Lexlegis Solutions Private Limited, a private limited company registered in India under the Companies Act, with its registered office in Mumbai, Maharashtra. Certificate of incorporation and GST registration are available on request under NDA.

Lexlegis.ai is a SaaS legal research and drafting platform powered by LLMs. Live capabilities include AI-assisted case law search, summarisation, contract review, drafting copilots, and a Q&A research assistant trained on Indian legal corpora. Enterprise offerings include custom workflows, API access, and tailored deployments for law firms, corporates, and courts.

The Lexlegis.ai platform is proprietary. We use a combination of fine-tuned open-source foundation models and proprietary retrieval, ranking, and legal-domain adaptation layers. The legal datasets, prompts, guardrails, and orchestration logic are fully owned by Lexlegis.

Yes. Lexlegis.ai provides REST API access for enterprise clients to integrate legal research, drafting, and summarisation into their internal systems. On-premises and VPC-isolated deployments are available for regulated clients (banks, government, large law firms) on request.

Yes. Lexlegis maintains documented AI governance policies covering responsible AI use, bias mitigation, model lifecycle management, data handling, and security. Policies are reviewed at least annually and aligned to ISO 42001 principles and the NITI Aayog Responsible AI guidelines. The Lexlegis AI Governance Policy establishes principles of responsible AI across the platform: fairness and bias mitigation, transparency and explainability, human oversight for high-risk outputs, data minimisation and privacy, security-by-design for models and datasets, and a defined model lifecycle (design, data review, evaluation, approval, monitoring, retirement). Roles and responsibilities are assigned to the Responsible AI Committee, Engineering, and InfoSec.

Yes. Lexlegis has an internal Responsible AI Committee comprising the CEO, CFO, Product Lead, and Head of Software Engineering. The committee reviews new model releases, high-risk use cases, and incidents on a defined cadence.

New AI features pass through a defined release gate: requirement review, data and bias review, security review, model evaluation (accuracy, hallucination, fairness benchmarks), staging UAT, Responsible AI Committee approval, and production rollout with monitoring. Sign-offs are recorded.

User complaints and flagged AI outputs can be raised via in-product feedback, support email, and account managers. Each issue is logged in the ticketing system, triaged by support, escalated to engineering for safety-related issues, and tracked to closure with SLAs.

Yes. Lexlegis runs continuous monitoring covering model performance (latency, accuracy on golden sets), hallucination and grounding metrics, drift detection, abuse signals, and infrastructure security. Dashboards and alerts are reviewed by AI and InfoSec teams.

Lexlegis maintains an AI Incident Response Plan covering detection, triage, containment, eradication, recovery, customer communication, and post-incident review. AI-specific incidents (e.g., prompt injection, harmful output, data leakage via model) have defined playbooks and a severity matrix.

Yes. Lexlegis conducts internal AI risk assessments at design time and at least annually, and engages external auditors for VAPT and security audits. Risk assessments cover data, model, infrastructure, third-party, and ethical dimensions.

Yes. Audit logs are maintained for user access, admin actions, model invocations, data access, configuration changes, and security events. Logs are tamper-evident, time-synced, and retained per the log retention policy with restricted access.

Yes. Lexlegis maintains a Business Continuity and Disaster Recovery plan. Critical services run in multi-AZ configuration with automated failover, regular backups, and tested fallback paths (e.g., degraded read-only mode if AI services are unavailable).

Yes. Training and fine-tuning datasets are reviewed for source legitimacy, licensing, PII, and bias before use. Lexlegis primarily uses public Indian legal corpora (judgments, statutes, gazettes) and licensed content; client data is never used for training.

Training data is stored in access-controlled cloud storage with encryption at rest (AES-256) and in transit (TLS 1.2+). Access is RBAC-restricted to authorised ML engineers, logged, and reviewed periodically. Buckets and datastores are private with no public exposure.

Access to AI data and models is enforced via SSO + MFA, role-based access control, network segmentation, just-in-time privileged access, and secrets management. Production model artefacts are stored in restricted registries with signed access and audit logs.

Yes. External datasets are reviewed for licensing terms, source credibility, PII, malicious content, and alignment with intended use before ingestion. A documented review checklist is signed off by the data lead and the legal team where licences are involved.

Yes. Models are evaluated pre-release on legal benchmark sets covering accuracy, citation groundedness, hallucination rate, bias across jurisdictions, gender, and community lines, and adversarial prompts. Drift is monitored post-release and triggers re-evaluation.

Yes. Lexlegis.ai outputs are designed for explainability. Answers cite the underlying judgments, statutes, or clauses used. Users can drill into source documents, see the retrieved context, and verify the basis of any AI-generated answer or summary.

Yes. A model contingency plan covers detection of drift or quality degradation, automatic rollback to the last known good model version, fallback to non-AI keyword search, customer communication, and root-cause analysis before re-deployment.

Lexlegis is ISO 27001:2022 certified for its information security management system. SOC 2 Type II readiness is complete and the audit window is active.

Yes. All AI data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Encryption keys are managed via a dedicated KMS with role-based access, key rotation, and audit logging.

Application, security, and audit logs are retained for a minimum of 12 months in line with the Log Retention Policy, with longer retention for security and compliance-relevant logs as required by applicable regulation or contract.

Customer data is retained for the duration of the contract plus a defined post-termination period (typically 30 to 90 days) for recovery, after which it is securely deleted or anonymised per the Data Retention Policy and contractual terms.

Lexlegis follows a documented patch and vulnerability management process: continuous vulnerability scanning, dependency monitoring, severity-based SLAs (critical patched within days), regression testing, and controlled rollout. Models are also versioned and re-evaluated when underlying components are updated.

Lexlegis uses input and output guardrails, prompt-injection detection patterns, content filters, rate limiting, anomaly detection on prompts and responses, and red-team monitoring. Suspicious activity triggers alerts to the security team.

Yes. Real-time alerts are configured for model anomalies including error and latency spikes, sudden change in groundedness scores, abuse pattern detection, and unusual access patterns.

Yes. Access to Lexlegis AI systems uses role-based access control (RBAC). Roles are mapped to least privilege; SSO + MFA is enforced for all internal users and admin consoles.

Yes. Privileged AI and admin accounts are separately monitored with enhanced logging, just-in-time access, session recording where applicable, and alerting on anomalous use. Privileged access is approved per request and time-bound.

Lexlegis is certified to ISO 27001:2022. ISO 42001 and ISO 27701 alignment work is in progress.

Lexlegis owns the IP in its proprietary models, prompts, fine-tuned weights, and platform. Customer inputs and outputs remain the customer's property as per the MSA; Lexlegis does not train on customer data. Open-source components are tracked with their licences.

User consent for data use is captured through the Terms of Service, Privacy Notice, and, where applicable, explicit in-product consent toggles. For enterprise clients, data-use terms (including no-training defaults) are governed by the MSA and DPA.

Yes. Where datasets contain personal data, Lexlegis applies anonymisation or pseudonymisation techniques such as PII scrubbing and redaction of names or identifiers in judgments where required.

Lexlegis applies multiple controls: RAG grounding with citations to authoritative legal sources, refusal or clarification on out-of-scope questions, bias evaluations, content filters, clear AI-disclosure to users, and human-in-the-loop for high-risk workflows.

Third-party AI components (foundation models, libraries, cloud services) are reviewed before onboarding for security posture, licence, data handling, and compliance certifications. Ongoing monitoring covers known vulnerabilities and licence changes.

On contract termination, Lexlegis deletes customer data from production and backups within the contractually agreed window (typically 30 to 90 days). A data deletion certificate is issued on request.