Security
Technical controls with clear assurance boundaries.
LexLitmus Workspace is developed as a separate customer product with defence-in-depth around identity, tenant isolation, document processing, AI governance, audit and operations.
1. Customer-product separation
Workspace and LexLitmus Internal / Professional are separate builds. Customer Workspace does not normally include corpus administration, supplier-global administration, Secure Upload Lab or internal engineering/operations functionality. Release gates are designed to prevent those boundaries from regressing.
2. Organisations, matters and access
Access is enforced server-side. Users are linked to organisations and roles, and matters/documents/analyses/drafts remain Matter-scoped. Cross-tenant tests actively attempt unauthorised access across organisations.
Identity
The production model supports OIDC/SSO, including Microsoft Entra. Local password login can be disabled so the organisation's IdP is authoritative for authentication and MFA/Conditional Access.
3. Data processing and AI
Workspace supports local-only processing. External AI is not a hidden fallback. If an external provider is enabled, use is governed by the organisation's provider policy and selected processing mode. Clicking “generate draft” does not itself authorise external disclosure.
4. Files, encryption and malware
The architecture supports KMS-backed encryption and versioned keys. Document flows are designed for malware scanning, quarantine and controlled failure modes. Production-like staging has been exercised with real ClamAV and durable storage.
5. Audit, retention and legal hold
Material actions are recorded with audit and correlation IDs without needlessly duplicating sensitive content. Retention is configurable. Legal hold can prevent automated deletion of material that must remain preserved.
6. Secure runtime and supply chain
The tested backend runs non-root with reduced Linux capabilities. The release process includes SBOM generation, dependency scanning, vulnerability management, production configuration validation and automated gates for migrations, product separation and frozen legal-core integrity.
7. Backup, export and exit
Backup and restore have been exercised in isolation. Workspace supports organisation-level export and offboarding. Subscription expiry is not a data-deletion trigger; retention, legal hold and exit are handled separately.
8. Security testing
Workspace has been exercised in production-like staging and tested internally using OWASP ZAP, targeted regression tests and accessibility tooling. Findings from internal testing were remediated and re-tested.
Internal security testing is not an independent penetration test. Self-assessment is not external accessibility certification. Technical GDPR/NIS2/AI evidence is not the customer's own DPO or legal approval. Those boundaries are deliberately documented.
9. Regulatory and procurement evidence
Workspace includes documentation and technical controls designed to support customer review of GDPR/DPIA, NIS2/supply-chain, public-sector security, AI governance/FRIA, CRA, Data Act and EN 301 549. The legality of a concrete deployment depends on the customer's use case, data, legal basis, hosting and governance.