Security and compliance at Lexcel
Lexcel holds a SOC 2 Type II report with an unmodified opinion, stores customer data on AWS in the United States, and encrypts it in transit and at rest. Here is what a security reviewer checks, with the full report available under NDA.
SOC 2 Type II
Prescient Assurance LLC, an AICPA member CPA firm, issued Lexcel an unmodified SOC 2 Type II opinion, following a completed Type I examination. Lexcel’s security and compliance framework is aligned with the AICPA Trust Services Criteria, and Secureframe monitors its posture continuously.
- Auditor
- Prescient Assurance LLC
- Audit period
- December 1, 2025 to March 20, 2026
- Opinion
- Unmodified
- Report dated
- April 17, 2026
How Lexcel protects your data,
from where it is stored to who can reach it.
Hosted on AWS in the United States
Customer data is stored in AWS US-East-2 (Ohio). The platform runs on Amazon EKS, Amazon RDS, and Amazon S3, with production workloads across multiple availability zones where supported.
Encrypted in transit and at rest
All sensitive client data is encrypted with TLS 1.2 or higher in transit and AES-256 at rest, using AWS-managed keys through AWS KMS and Secrets Manager. Data exports are encrypted, access controlled, and tracked.
Isolated networks and environments
The platform runs with VPC-based network isolation, private subnets, and security groups, and only approved ports and protocols are exposed. Web traffic passes through WAF and DDoS protections, and non-production environments are isolated and use de-identified data by default.
Administrator access with SSO and MFA
Production access is role-based and limited to a small number of named administrators, who use it only to resolve operational issues and, at a customer’s request, to support that customer’s engagement. They reach AWS through AWS IAM Identity Center single sign-on with multi-factor authentication, and their sessions and commands are logged.
Monitored and logged
AWS CloudTrail, CloudWatch, GuardDuty, and Security Hub watch the environment, with alerts feeding incident response. Administrative, authentication, authorization, change, and export events are logged centrally and protected against tampering.
Accountable people and policies
Lexcel’s CEO is accountable for security, privacy, and compliance, and its CTO operates the technical controls. Personnel complete security awareness training at onboarding and every year, background screening and confidentiality agreements are required, and the risk assessment is refreshed at least annually.
AI models your organization chooses,
with zero data retention at Anthropic, OpenAI, and xAI.
Lexcel uses AI models from multiple providers, to the extent each customer elects to use them. Lexcel holds zero data retention agreements with providers including Anthropic, OpenAI, and xAI: client data sent to them is not used for model training and, by default, is not stored by the provider.
A model from a provider without a zero data retention agreement is turned on for an organization only with that customer’s consent. Agent outputs can cite the source materials behind them, and every output stays subject to your underwriters’ judgment.
Subprocessors
Subprocessors are limited, vetted, and documented, and key providers are assessed and monitored. The current list is available under NDA.
-
Amazon Web Services
Hosting
-
AI model providers
Including Anthropic, OpenAI, and xAI, to the extent the customer elects to use each provider
-
Microsoft Azure
Document processing
-
Other approved service providers
Including vendors for audio transcription and complex document processing
Processing vendors may retain data temporarily to complete processing.
Request the full SOC 2 report
Lexcel shares its SOC 2 reports and supporting documentation under NDA for your assessments, along with the current subprocessor list.
Questions security reviewers ask
How long does Lexcel keep our data, and how is it deleted?
Lexcel keeps client data for the length of the customer relationship and deletes it on request or when the contract ends. Access, export, and deletion requests follow established procedures.
That covers the files your team uploads or sends to a connected inbox, the workbench records built from them, AI queries and responses, and workflow outputs, plus the limited system metadata needed to run the platform.
How does Lexcel back up customer data?
Automated daily snapshots of the Amazon RDS databases are encrypted with AES-256 and kept for 30 days, and point-in-time recovery is enabled. Test restores run periodically in a non-production environment, and disaster recovery plans, built on infrastructure as code, are reviewed and tested periodically.
Does Lexcel run penetration tests?
Yes. Lexcel has third-party penetration tests performed, and an external test was completed in March 2026. Material findings are remediated and re-tested, and AWS Inspector scans for vulnerabilities continuously in between.
What happens if Lexcel has a security incident?
Lexcel follows a tested incident response plan with defined roles and communications, from detection and triage through containment, eradication, recovery, and lessons learned. Customers are notified in line with contractual and regulatory requirements, and corrective actions are tracked to closure.
What AI models power Lexcel?
Lexcel supports multiple AI model providers (including Claude, OpenAI, and others). Which models are available is configured at the organization level, so each firm can choose what fits its policies, preferences, and workloads. Quality still comes from line-specific tools and prompting built for specialty insurance workflows, not from any single base model alone.
Connects everywhere you work,
and works with your existing systems.
Security and compliance
Built for enterprise security.
SOC 2 Type II
Start with one process.
We’ll run it on Lexcel with you.
Bring a line of business or a review your team wants to move faster, and we’ll walk through it on the workbench, from the first email to your systems.