The material remains
with the agency.
An ongoing dispute contains opposing party material, the client's most sensitive information, and material covered by attorney-client privilege. LexBox is built to allow the firm to use AI in this work without the material leaving the firm's own file, and without it leaving the EU.
· Security documents for IT, safety and compliance
· Last updated August 20, 2026 · Version 1.2
The file remains where it is
LexBox is mirrored against the documents in the firm's iManage, SharePoint, Dropbox, or Google Drive.
All processing within the EU
No part of the chain, including the model, processes material outside the EU.
Zero data retention
No material is saved by the model provider after processing.
No model training on customer data
The agency's material is never used to train or fine-tune models.
Status
GDPR
Fulfilled
LexBox processes personal data as a processor for the firm, with a data processing agreement and documented processing operations.
EU data residency
On site
Processing and storage take place within the EU. Models that process data outside the EU are not used.
SOC 2 Type II
Planned
We are not certified today. An audit is planned, and in the meantime, we respond to agencies' own security reviews.
ISO 27001
Planned
Not certified today. We work towards the standard's controls and present them upon request.
Treatment
Data processing
The documents remain in the agency's document management system
Zero data retention with the model provider, regulated by contract
No training or fine-tuning of models on the agency's material
A data processing agreement is signed with each agency
Infrastructure
All processing and storage within the EU
Separate instance per agency, no shared database between customers
Encryption in transit and at rest
Logging of processing per case and user
Access
Single sign-on via the agency's own identity provider
LexBox staff do not have access to the firm's cases without written consent
The permission model in the agency's document management system is carried over into LexBox
Data processing
LexBox is the personal data processor, the firm is the personal data controller
Data processing agreement and list of sub-processors are available upon request
Built for Swedish legal practice and Swedish procedural law
Architecture
The agency retains its file
Other AI tools require the firm to upload its material to the provider's platform. LexBox does the opposite. The documents remain in the firm's own document management system, and LexBox works with them there. What is created in LexBox can be synced back to the file. The firm's archive remains the firm's archive.
Model selection
Which model is used is a security decision
Most AI tools choose a model based on performance and price. We choose it first based on where it processes data. A model that sends material outside the EU is not used in LexBox, regardless of how good it is. This limits us sometimes. That is the intention.
At the end of the contract
You take everything with you. If you terminate the agreement, you will receive a complete export of all material and everything created in LexBox, before anything is deleted. After that, the agency's data is permanently deleted. You should stay because the product is good, not because it is difficult to leave.
Security review
Response time
Supporting documents within two working days. Completed supplier form within five working days.
Most suppliers send a standard document and refer to their trust center. We do the opposite. We fill out the agency's own supplier form, go through your questions with your IT and compliance function, and sign your data processing agreement instead of requiring you to sign ours.
We are a smaller company than several of the alternatives. This means you get answers from those who built the system, not from a support function.
Documentation you can order
1
2
List of sub-processors
3
Description of processing and data flows
4
Completed supplier form from your IT function
5
Reporting on the work towards the ISO 27001 controls
Questions from your IT or compliance function: sakerhet@lexbox.se
FAQ
What is LexBox?
How does the process graph work?
Does LexBox replace the lawyer's assessment?
What types of documents can I upload?
Which features are included in the product?
START YOUR NEXT MOVE
LexBox applies the same structural framework to arbitration, adapted to arbitral rules, confidentiality, and procedure.
Copyright ©LexBox AB. All rights reserved.