Skip to content

Security

How Lexix keeps sensitive data in its place

Every message is checked before it leaves. Here's how routing works, and how we protect the API keys you bring.

Sensitivity routing

Before a message is sent to any AI provider, Lexix classifies it and picks a provider your admin has approved for that level.

  1. 01

    Classify

    Pattern matching catches card numbers, personal identifiers and credentials instantly. A semantic classifier then weighs the rest. The result is one of four levels: public, internal, confidential or restricted.

  2. 02

    Route

    Admins decide which providers may receive each level. Everyday work can go to frontier models like Claude or OpenAI; restricted content can be limited to an Ollama model you run yourself.

  3. 03

    Block, never downgrade

    If no approved provider is available for a confidential or restricted message, it is blocked. It is never quietly sent somewhere less secure.

  4. 04

    Record

    The classification, the reason and the provider used are stored with each message. Users see why; admins inspect decisions and tune patterns, examples and thresholds for their organisation.

Classification is a safeguard, not a guarantee. Like any classifier it can miss things, so we recommend pairing it with a clear AI-use policy and restricting the most sensitive levels to providers you fully control.

Bring your own keys

You use your own API keys from OpenAI, Anthropic, Google or Groq. You pay providers directly, see exactly what you spend, and can revoke a key from their dashboard at any time.

Encrypted at rest

Keys are encrypted with AES-256-CBC before they are stored. They are never kept in plain text.

protected function casts(): array
{
    return ['value' => 'encrypted'];
}

Scoped to your organisation

Keys are stored against your organisation and marked tenant-only, so they never fall back to another organisation's or a global value.

Scrubbed from logs

Every log entry passes through a sanitiser that masks keys, tokens and credentials before it is written.

Bearer sk-…
→ Bearer ***MASKED_TOKEN***
eyJhbGciOi…
→ ***MASKED_JWT***

Server-side only

Keys are decrypted in memory to call the provider over HTTPS. They are never sent to the browser.

browser → lexix server → provider

Hidden from view

After saving, a key shows as "***". Admins can replace it but never read it back — so it can't leak through a screenshot or screen share.

Recommended at your provider

  • → A dedicated key just for Lexix
  • → Spending limits on that key
  • → Periodic usage checks and key rotation
  • → Ollama for fully local processing

Questions

Can Lexix staff see my API keys?

Keys are encrypted at rest with AES-256-CBC. Database access alone is not enough to read them — decryption also needs the application's secret key, which is held separately.

What if Lexix were compromised?

You control your keys at the source. Revoke them from your provider dashboards (OpenAI, Anthropic, Google, Groq) and access stops immediately.

Do you store my conversations?

Yes — conversations are stored in your workspace so you can come back to them. Messages pass through Lexix's servers on their way to the provider they're routed to. We don't use your conversations to train models.

Can other organisations see my keys or rules?

No. Keys, classification rules, analytics and message records are all scoped to your organisation.

Give your team AI you don't have to worry about.

Free during beta. Bring your own API keys.

Start free