Pre-launch draft — Lexboard is not yet operating as a legal entity. These documents are drafts under legal review and are not yet in effect or binding.
Legal
Lexboard engages the following third-party service providers ("subprocessors") to deliver the Service. Each subprocessor is bound by contractual data-protection obligations equivalent to or stricter than those Lexboard provides to its customers.
We give at least thirty (30) days' advance notice of any new or replacement subprocessor by (i) updating this page and (ii) emailing each customer firm's designated administrators at their account email addresses. Customers may object in writing within the notice period; if no mutually acceptable resolution is reached, the customer may terminate the affected subscription without penalty and receive a pro-rata refund of prepaid, unused fees.
AI processing note. AI requests are processed by Anthropic, PBC (generative features) and OpenAI (Whisper speech-to-text for call/voicemail transcription and text embeddings) via their commercial APIs, which prohibit training on customer content; providers may retain API data for a limited period (typically up to 30 days) for abuse monitoring, then delete it. Content submitted to AI features (including medical-record text) is transmitted as uploaded — Lexboard does not automatically redact identifiers before transmission. Firms should not invoke AI features on material they may not disclose to a third-party processor. Firms that connect their own Anthropic API key are governed by their own agreement with Anthropic.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Postgres database, Auth, Realtime, Object Storage | All firm + client data (encrypted at rest) | United States (AWS us-east-1) |
| Vercel | Application hosting + Edge runtime + analytics | HTTP request metadata, build artifacts | United States + global edge |
| Stripe | Payment processing for firm SaaS subscriptions only (Lexboard does not process client or trust funds) | Billing contact info, payment tokens (no card numbers stored by us) | United States |
| Sentry | Application error monitoring | Error stack traces (PII scrubbed where feasible) | United States |
| Anthropic | Primary AI provider: intake extraction, demand-letter drafting, case analysis, chronology | Case documents and case facts as submitted by the firm (not redacted by Lexboard). No training on customer content per Anthropic's commercial API terms; limited retention (typically up to 30 days) for abuse monitoring, then deleted | United States |
| OpenAI | Speech-to-text (Whisper) for call-recording / voicemail transcription, plus text embeddings for document search (no generation) | Full call/voicemail audio when the firm enables transcription; document and case text for embeddings, as submitted (not redacted by Lexboard). No training on customer content per OpenAI's API terms; limited retention (typically up to 30 days) for abuse monitoring | United States |
| Resend | Transactional email (esign invites, portal links, password reset) | Recipient email, message subject + body | United States |
| Google (Gmail, Calendar, Drive, Sheets APIs) | OAuth-based Google Workspace integrations for firms that opt in (email, calendar sync, linked Drive folders, Sheets) | Email message bodies + attachments, calendar events, linked Drive file metadata and contents, spreadsheet data (firm's own Google account) | United States (firm's chosen region) |
| Microsoft (Outlook / Graph API) | OAuth-based Outlook integration for firms that opt in | Email message bodies + attachments (firm's own Microsoft account) | United States (firm's chosen region) |
| RingCentral | Firm-elected telephony integration (opt-in): calls, SMS, voicemail | Call logs, call recordings, voicemails, SMS message content, phone numbers (firm's own RingCentral account) | United States |
| Twilio | SMS delivery for client/firm messaging | Recipient phone numbers + message bodies | United States |
| Browser push services (Google FCM / Apple / Mozilla) | Web push notification delivery to users' browsers | Encrypted push payloads (notification titles / snippets) | United States + global |
| Upstash | Rate-limiting infrastructure (Redis), when enabled in production | IP addresses + request counters (no case content) | United States |
We notify designated firm administrators by email whenever this page changes. Customers may also subscribe directly by emailing legal@lexboard.net with the subject line "subprocessor updates".
Last updated: July 2, 2026