Trust & support

Security & trust

What a security reviewer needs to know before putting Lexicor on the request path: how access is controlled, how tenant data is handled, and why the audit record can be trusted. Where something is planned rather than attested, this page says so.

Security posture

Lexicor sits on the request path as a mediation and evidence layer. Two properties shape everything else on this page:

• Deterministic and fail-closed. Policy checks are deterministic — the same input produces the same disposition — and unknown or incompatible inputs are rejected rather than passed through. A 422 policy rejection is the system working, not an error.
• Evidence by default. Every disposition is recorded to an append-only, tamper-evident ledger you can query, export, and hand to an auditor. See Compliance export.

Authentication and access

• API keys are tenant-scoped and sent in the X-API-Key header. A key stays inactive until the account email is verified.
• Keys carry roles — reader < operator < admin. Higher-privilege operations (audit-lake queries, replay) require admin; compliance reports require operator or higher.
• Rotation is immediate. Rotating a key invalidates the old one at once; retrieve the current key from the console.
• Console sign-in supports password and configured identity providers, with optional authenticator-app MFA. Cloud sessions expire after 12 hours.

Data handling and retention

• Transport encryption. All hosted endpoints are served over TLS. For self-hosted deployments, terminate TLS at your reverse proxy or load balancer — see Self-hosting.
• Tenant scoping. Keys, configuration, ledger entries, and audit-lake data are scoped to your tenant. Cross-tenant access is not part of any API surface.
• Retention follows your plan. Hot and warm retention windows differ by tier — see Plans & pricing.
• Payment data is handled by Stripe Checkout; Lexicor does not store card details.
• Self-hosting keeps all request payloads and evidence inside your own environment — see Self-hosting.

Audit-evidence integrity

The ledger is append-only and tamper-evident: after-the-fact edits are detectable, and dispositions are reproducible — an auditor can re-run a decision and get the same answer. Evidence packs export the record in a reviewable form without exposing raw system internals. This is the property that makes the record evidence rather than telemetry.

Availability and status

Platform status is published at status.lexicor.io, and the API exposes an unauthenticated health probe at /v1/health. Rate limits and fair-use caps by tier are documented on Plans & pricing.

Certifications (honest status)

Enterprise procurement teams can request the current security documentation through their account contact.

Reporting a vulnerability

If you believe you have found a security issue, email partnerships@lexicor.io with a description and reproduction steps. Do not include your API key or other credentials in the report. We acknowledge reports and coordinate disclosure with the reporter.