Subprocessors
Last updated: 13 September 2026
Lexona uses the third-party providers below to host and operate the Lexona.AI platform and website. Where they process Client and Matter Data for our customers, they act as our subprocessors. A second list names the services that load in your browser and receive technical information such as your IP address.
Current providers
For each provider this list gives its purpose, the kind of data involved, and where it is hosted or processed where we have established that. It does not describe each provider’s contractual terms.
| Provider | Purpose | Data involved | Hosting or processing region | Use |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting (compute) for the Lexona platform | All data the platform processes, including Client and Matter Data | Germany | In use |
| Supabase | Database, authentication and document storage | Client and Matter Data, user accounts and authentication events | United Kingdom | In use |
| Qdrant Cloud | Vector search | Text excerpts of documents and their numerical representations (embeddings) | United Kingdom | In use |
| OpenAI | AI model processing and embeddings | Prompts, document excerpts and page images, matter context, and outputs | Global API service; not pinned to a region by Lexona | In use (default AI model provider) |
| Mistral AI | Document text extraction (OCR) | Documents submitted for text extraction | Global API service; not pinned to a region by Lexona | In use |
| Cloudflare | DNS, encrypted network ingress, and protection of forms against automated abuse | Network traffic to and from the platform; browser and device signals on protected forms | Global edge network | In use |
| Vercel | Hosting of the lexona.ai website and its enquiry forms | Website request data and enquiry form submissions (not Client or Matter Data) | United Kingdom (server functions); global edge network (static content) | In use |
| Anthropic | AI model processing | Prompts, document excerpts, matter context, and outputs | Global API service; not pinned to a region by Lexona | Only if a customer practice selects an Anthropic model |
| Mail servers chosen by a customer practice | Importing email into matters | Email messages and attachments from the connected mailbox | Chosen by the customer practice | Only if a customer practice connects a mailbox |
Services loaded in your browser
These services receive technical information such as your IP address and browser details when a page loads them. They do not receive Client or Matter Data. Our Cookie Policy describes any storage they use.
| Provider | Purpose | Where it is used | What it receives |
|---|---|---|---|
| Cloudflare Turnstile | Protects our enquiry, demo-request and security-pack forms from automated abuse. | Pages with one of those forms | Your IP address and the browser and device signals Cloudflare uses to run the check. In our testing on 13 September 2026 it set no cookies in the browser. |
| Google Fonts | Loads the typefaces used by the platform interface. | Signed-in platform pages | Your IP address and browser information when the fonts load. |
| Flaticon and Wikimedia Commons | Displays file-storage provider icons. | A matter's file panel | Your IP address and browser information when an icon loads. |
| Cloudflare Turnstile | Protects public intake forms that legal practices publish from automated abuse. | Public intake forms | Your IP address and the browser and device signals Cloudflare uses to run the check. |
AI model providers
We do not use Client or Matter Data to train AI models. Where configured and contractually available, model providers are used with enterprise privacy controls designed to limit provider retention and model training. Retention and model-training terms depend on each provider’s agreement and account configuration.
Integrations that are not listed
Integrations shown on our website as planned, proposed or not yet available — including document-storage connectors and practice-management platforms — are not listed, because no customer data is sent to them. This list is updated before a new provider processes Client or Matter Data.
Changes and questions
Customers with a Data Processing Agreement are told about changes to this list as that agreement provides. International transfers are described in our Privacy Policy, and further detail is available through our security pack.