Matter-scoped access
Permissions follow the firm, matter, person, and work they are authorised to see.
LxOS Trust Center
Confidence should be designed into the matter.
For legal teams in Australia and the United States, LxOS is built to preserve client confidentiality, limit information handling to what is necessary, and keep access, review, and activity accountable.
Last updated 17 September 2026
Our position
Controls first. Assurance earned independently.
Client confidentiality and data minimisation shape how LxOS is designed and operated. We seek to collect and handle only the information reasonably necessary to provide, secure, and support the service. Our security and privacy program is being developed with reference to recognised frameworks as we work toward formal assurance.
Product controls
Protection that follows the work.
The strongest safeguards are part of the everyday workflow, not a separate administrative layer.
Default-deny sharing
External access is bounded to the relevant matter and can expire or be revoked.
Recorded activity
External document views and access changes are designed to leave an accountable history.
Reviewable AI
AI-assisted document changes remain visible for lawyer review before they become work product.
Operating principles
Built for client confidentiality. Deliberate about every piece of information.
Least necessary access
People should see only the matters and materials required for their role, for only as long as that access is needed.
Collect with purpose
Information should be collected or generated only when it serves a clear product, security, support, contractual, or legal need.
Confidentiality follows the matter
Client information remains bounded to the authorised firm, matter, and people—not repurposed for advertising or sold to third parties.
Human judgment remains decisive
Lx assists legal work; it does not replace the professional responsibility to review advice, documents, and decisions.
Boundaries should be visible
Sharing, client visibility, and AI-proposed changes should be explicit enough to inspect, understand, and reverse.
Assurance is an operating practice
Policies matter when they have owners, evidence, review cycles, and a clear account of what is—and is not—verified.
Framework direction
Recognised standards, reflected in our direction.
These frameworks guide program development for the markets we currently serve. They are not substitutes for certification, an independent attestation report, or a legal determination of compliance.
APPProgram reference
Australian Privacy Principles
For customers in Australia, we are developing our privacy program with reference to the Privacy Act 1988 (Cth) and the APPs, including transparent handling, purposeful collection, controlled use and disclosure, information security, and individual access and correction rights.
SOC 2Readiness underway
Trust Services Criteria
The SOC 2 Trust Services Criteria inform how we develop controls for access, change management, system operations, risk management, and confidential information. LxOS has not yet completed an independent SOC 2 examination, and no SOC 2 report has been issued.
27001Framework informed
ISO/IEC 27001
ISO/IEC 27001 informs our risk-led approach to security governance, control ownership, access, operations, incident management, and continual improvement. LxOS is not currently certified to ISO/IEC 27001.
HIPAAUse-case assessment
Health information safeguards
For US customers whose work may involve protected health information, HIPAA's administrative and technical safeguards inform our assessment of the required controls and contractual arrangements. LxOS does not currently represent the service as HIPAA compliant.
Common questions
What firms ask before they sign.
Short answers to the questions that come up first in procurement. Our Privacy Policy has the detail.
Is client information sold or used for advertising?
No. We do not sell personal information or use Customer Content for third-party advertising. It stays bounded to the authorised firm, matter, and people.
Is our data used to train AI models?
Never without your explicit consent. Nothing your firm places in LxOS is used to train models unless you have expressly agreed to it.
Where is our data kept and processed?
Your data is stored onshore in Australia, New Zealand, or the United States. By default that covers storage only: AI processing may happen offshore. Onshore AI processing is available on request.
Can AI change a document without a lawyer?
No. AI-assisted changes are proposals. They stay visible and reversible, and become work product only when a lawyer accepts them.
Does it work with our email and Word documents?
Lawyers can optionally connect a Gmail, Outlook.com, or Microsoft 365 mailbox, and can disconnect it at any time. Drafts export as Word documents and PDFs.
Does it replace our practice management system?
No. LxOS does not handle billing or accounting yet, so it is not a practice management system. It is an operational workspace that works alongside the one you already use.
What does it cost?
Pricing starts from US$199 per seat per month.
Which AI providers power LxOS?
AI-assisted features run on models from OpenAI and Perplexity.
OpenAI
Perplexity
Questions and diligence
Trust is a conversation we are prepared to have.
For privacy questions, security reviews, or procurement diligence, contact our team. Information may be provided subject to appropriate confidentiality arrangements. LxOS is built by Rune AI, so our team answers from a rune-ai.co address.
team@rune-ai.co