Security at Lex.
Lex is a compliance workspace, so the way we run it matters. This page describes the infrastructure, access model and third parties behind the product.
Hosting and data location
The Lex application, API and PostgreSQL database run on a dedicated Hetzner server in Helsinki, Finland. Evidence files uploaded to Lex are stored on the same server in the application's data directory. The product is served by Caddy over HTTPS.
Analytics is handled by PostHog hosted at ph.getdumont.ai, which is operated by Dumont. Page views on this marketing site are recorded there. Product analytics inside Lex follow the same setup.
Access and authentication
Lex uses Dumont Auth, built on ZITADEL, for sign-in. You can sign in with Google, Microsoft, a passkey, or your own SSO connection. Sessions are issued by the Lex API and carried as bearer tokens on requests.
Workspace data is separated by organization in the application layer. We are actively tightening route-level authorization across the product. If your security review needs the current state, ask us and we will give you a straight answer rather than a claim on a marketing page.
Auditability
Lex records changes in an audit log with the actor, the action and the time. Control status changes, evidence updates and administrative actions are the records auditors most often ask to see. The log is available in the workspace.
Transport and payments
All pages and API calls are served over TLS. Payments are handled by Stripe. Lex does not store card numbers. Transactional email and inbound compliance mail are delivered through Resend and Amazon SES.
Subprocessors
These are the third parties that may process data on our behalf. The list changes as the product does; the current version is below.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Application, database and evidence file hosting | Helsinki, Finland |
| Cloudflare, Inc. | DNS and network security | Global |
| Stripe, Inc. | Subscription billing and payment processing | United States |
| Resend, Inc. | Transactional email and email delivery | United States |
| Amazon Web Services, Inc. | Inbound email delivery for updates.runlex.ai | United States (us-east-1) |
| Dumont (PostHog, Bugit, Dumont Auth) | Product analytics, error tracking and identity | Dumont infrastructure |
Data processing and legal
Lex is operated by Dumont Pty Ltd. The Data Processing Agreement, Privacy Policy and Terms of Use cover the service. You can contact us for a security review, a completed questionnaire or our current subprocessor list as a document.
Reporting a vulnerability
If you believe you have found a security issue, email security@runlex.ai with enough detail to reproduce it. We ask that you do not test against customer data or run disruptive tests. We will acknowledge your report and keep you updated on the fix.
What Lex is not
Lex is a workspace that supports your ISO 27001, SOC 2, NIST and CMMC programs. Lex is not a certification body, does not issue certificates and does not replace your auditor. Any statement on this site about a framework means the framework is supported in the product, not that Lex or your organization is certified.
Need the security package?
You can ask for the current questionnaire, subprocessor list and DPA, and we will send them over.