Lexgo Sign security practices

1. Platform controls

a. Architecture and data segregation

Lexgo Sign services run on a multi-tenant architecture at both the platform and infrastructure layers, designed to segregate and restrict access to the data customers make available through those services. The architecture provides a logical separation of data for each customer through a unique ID.

b. Public cloud infrastructure

Lexgo Sign services are hosted on the internet in a public cloud: computing services offered by outside providers to anyone who wants to use or buy them. Like all cloud services, a public cloud service runs on remote servers managed by a provider, which in this case is Amazon Web Services, Inc. (AWS).

c. Audits

To check that our security practices hold and to look for new vulnerabilities, Lexgo Sign services undergo quarterly security assessments by internal staff. In parallel we use automated, hybrid, and continuous analysis of our web platform to reduce the chance of introducing new vulnerabilities into our code.

For the company's internal administrative processes and compliance with Chile's Law 20,393 on the Crime Prevention Model, Lexgo Sign relies on outside compliance firms such as Skyward.ai, which audit our services periodically. These audits check that the measures needed to meet the Crime Prevention Model and the Lexgo Code of Ethics have been adopted.

d. Security controls

Lexgo Sign implements and maintains appropriate technical and organizational measures to protect customer data against accidental or unlawful destruction, loss, and alteration, and against unauthorized disclosure of, or access to, the customer's personal data. Lexgo Sign services include several security controls, among them:

• Access log. Access logs are available both to customers and to the Lexgo Sign internal team. We record each time an account is signed in to, including the type of device and the IP address of the connection. Team administrators and supervisors can review the consolidated access logs for their whole team.
• Access management. Customers can remotely end every connection and sign out every device authenticated to Lexgo Sign services at any time, on request.
• Data retention. Unless a customer asks for all of their data to be deleted, Lexgo Sign keeps copies of every document and piece of data generated. This is how we work to prevent accidental destruction and loss of data.
• Host management. We run automated vulnerability scans on our production hosts and remediate findings that pose a risk to our environment. We use screen locks and full-disk encryption on company laptops.
• Network protection. Besides system monitoring and logging, we require two-factor authentication for every access to our production environment. Firewalls are configured to industry practice, using AWS security groups and virtual networks.
• Product security practices. New features, significant functionality, and design changes go through a cross code review and a security review led by the security team. Our code is also audited with automated static analysis, then tested and reviewed by hand by specialists before it is shipped to production. The security team works closely with development teams to resolve any further security issue that comes up during development.
• Customer two-factor authentication. Team administrators and supervisors can require every collaborator to turn on two-factor authentication for their account.

Some of these controls cannot be turned off by the customer. Others let customers tailor the security of Lexgo Sign services for their own use. Protecting customer data is therefore a shared responsibility between the customer and Lexgo Sign. At a minimum, Lexgo Sign aligns with prevailing industry standards such as ISO 27001, ISO 27002, and ISO 27018, or any successor or replacement standard.

Lexgo Sign may run security analysis and tests on the platform, on its workflows, and on the applications that run on Lexgo Sign infrastructure, to detect abusive behavior or actions that breach the terms of the services.

e. Vulnerability review and security patches

At Lexgo Sign we continuously review public vulnerabilities (Common Vulnerabilities and Exposures, or CVEs) for every library and dependency in our software.

Lexgo Sign uses GitHub Dependabot to keep every library and dependency current, and so to protect the supply chain. Every week they are updated to the latest stable minor version, and every month every major version that has been published and is considered stable is updated. By keeping dependencies current, Lexgo Sign stays inside security windows, which makes it possible to patch systems more efficiently when a vulnerability is reported.

Lexgo Sign also uses Snyk to identify, patch, and mitigate potential security incidents. Every week, public vulnerabilities (CVEs) rated medium or low are patched. For CVEs rated high, the security team is notified automatically so the corresponding patch can be applied as soon as possible.

f. Intrusion detection and security logs

Lexgo Sign monitors security logs on its production servers and is alerted to anomalies. Those anomalies and their security logs are reviewed by the security team. This helps Lexgo Sign detect possible unauthorized intrusion or misuse of the platform, and keep the service secure and available for our customers.

g. Incident handling

Lexgo Sign keeps policies and procedures for handling security incidents. Lexgo Sign notifies affected customers without undue delay of any unauthorized disclosure of their data by Lexgo Sign or its providers that it becomes aware of, to the extent permitted by law. Lexgo Sign publishes system status on the Lexgo system status site. Lexgo Sign will notify customers of significant system incidents by email.

h. Data encryption

Lexgo Sign services use industry-recommended encryption products to protect customer data (1) during transmission between a customer's network and Lexgo Sign services, and (2) when it is at rest in Lexgo Sign's custody.

All information stored in the Lexgo Sign database and infrastructure is encrypted at rest with algorithms such as AES-256, using services aligned with the FIPS 140-2 information processing standard.

Lexgo Sign services use recommended encryption protocols for traffic in transit, such as TLS 1.2 or higher. We also balance that with compatibility for older clients through fallback protocols, so the service stays accessible.

i. Reliability, backups, and business continuity

We know many customers rely on Lexgo Sign services to work. We are committed to high availability they can count on.

Our infrastructure runs on systems that tolerate failure, whether from a single server or from an entire data center. Our operations team regularly tests disaster-recovery measures and keeps a team on call 24 hours a day to resolve unexpected incidents quickly.

Lexgo Sign makes regular backups of its systems, so software changes can be rolled back and data replicated when needed. Whenever possible, Lexgo Sign will help the customer recover data after a significant catastrophic event, as local data-residency requirements and in-region capabilities allow.

Customer data is stored redundantly in several locations in our hosting providers' data centers to keep it available. We have tested backup and restore procedures, which allows recovery if a serious problem occurs. Customer data and our source code are backed up automatically overnight. The operations team is alerted if that system fails. Backups are evaluated at least every 90 days to confirm that our processes and tools work as intended.

j. Export of customer data

At any time, including after a contract ends, customers can request the return of their data stored in Lexgo Sign services, to the extent the customer has not deleted that data. Information about exporting data from Lexgo Sign services is available in our Help Center.

k. Deletion of customer data

Lexgo Sign services let administrators delete all customer data at any time during a subscription period. Twenty-four hours after the primary owner deletes it, and provided the operation is not undone or cancelled, Lexgo Sign permanently deletes all of that information from running production systems (team and customer names are excluded so deleted customers are not recreated). Lexgo Sign service backups are destroyed within 30 days. If a court investigation is underway, that period may be extended temporarily.

l. Confidentiality

We apply strict controls on our employees' access to our customers' data. Operating Lexgo Sign services requires that some employees have access to the systems that store and process customer data. For example, we may need to access customer data to diagnose a problem the customer has with Lexgo Sign services. Those employees are prohibited from using that permission to view customer data unless it is strictly necessary. We have technical controls and audit policies so that every access to customer data is recorded.

Every employee and contractor must follow our policies on customer data, and we treat these matters as questions of the highest importance in our company.

m. Personnel practices

Lexgo Sign runs background checks on every employee before hiring, and employees receive privacy and security training both during onboarding and throughout their time at the company. Every employee must read and sign our comprehensive information security policy, which covers the security, availability, and confidentiality of Lexgo Sign services.

2. Infrastructure

Lexgo Sign uses the infrastructure provided by Amazon Web Services, Inc. (AWS) to host or process customer data submitted to Lexgo Sign and generated by its services. Security information provided by AWS is available on the AWS security site. Information about AWS security and privacy audits and certifications, including ISO 27001 certification and SOC reports, is available on the AWS compliance site.