Sign inGet StartedOpen app
PricingTemplatesCompareBlogAboutSign inGet StartedAccountOpen app
Trust & Security

Security

How we protect your documents and data.

Last updated 16 June 2026

Security is foundational to a contract platform. This page summarises how Lexly protects your documents and data. It complements our Privacy Policy and Subprocessors page.

Encryption

  • In transit: all traffic to and from Lexly is encrypted with TLS (HTTPS).
  • At rest: documents stored in our object storage (AWS S3) are encrypted at rest using server-side encryption (SSE-S3 / AES-256). Our database (Supabase/PostgreSQL) is encrypted at rest by the provider.

Authentication & Access

  • Authentication is handled by Supabase Auth (email/password and Google OAuth). Passwords are hashed; we never store them in plaintext.
  • Sessions use HTTP-only cookies with short-lived access tokens and rotating refresh tokens; cross-origin requests are protected with SameSite=None; Secure cookies and a strict CORS allow-list.
  • Role-based access gates administrative functions; every user can only access their own contracts and data (ownership is enforced on every request).
  • Document download links are time-limited presigned URLs rather than public links.

Document Integrity & eSignatures

  • Each stored and signed document is fingerprinted with a SHA-256 hash so tampering can be detected.
  • The eSign flow records a tamper-evident audit trail (timestamps, IP address, approximate location, user agent, typed name, and consent) and issues a Certificate of Signature for every completed agreement.
  • Where enabled, signed PDFs carry a PAdES cryptographic signature.

Payments

  • Payments are processed by Lemon Squeezy as Merchant of Record. Lexly never receives or stores your full card number — card data is handled entirely by the PCI-compliant payment provider.

Infrastructure & Monitoring

  • The application runs on Vercel; data is stored with Supabase and AWS. We use scoped credentials and the principle of least privilege for service access.
  • Rate limiting (Upstash Redis) protects authentication, AI, and public verification endpoints against abuse.
  • Error and performance monitoring (Sentry) helps us detect and respond to issues quickly.
  • Administrative actions are audit-logged.

Data Retention & Deletion

  • You can delete your account at any time; doing so removes your user record and associated contracts (cascading to signatories, clauses, and audit events) and deletes stored files from object storage, subject to a short backup-rotation window and any legal retention obligations. See the Privacy Policy.

Responsible Disclosure

We welcome reports from security researchers. If you believe you've found a vulnerability, please email security@lexlyai.com with details and steps to reproduce. Please give us a reasonable opportunity to address the issue before public disclosure, and do not access or modify data that isn't yours. We will acknowledge your report and keep you updated.

Your Role in Security

  • Use a strong, unique password and keep your credentials private.
  • Only invite signatories you trust, and verify recipient email addresses before sending.
  • Contact us immediately at security@lexlyai.com if you suspect unauthorised access.

A Note on Assurance

No system is perfectly secure; we work continuously to protect your data but cannot guarantee absolute security. Lexly is operated by Devmint Technologies (Chandigarh, India); as we mature, we will publish any formal certifications, audits, or penetration-testing cadence here once they are in place.

Contact: security@lexlyai.com