Data Processing Addendum

1. Roles

The firm is the controller, or a processor acting for its clients. EdgeLex is the processor. EdgeLex processes personal data only on the firm’s documented instructions: the Terms of Service, the firm’s configuration of the platform, and the AI policy the firm sets.

2. What is processed

Personal data of the firm’s clients, opposing parties, witnesses, courts, staff and users, as contained in matters, documents, email, messages, recordings, transcripts, deadlines and billing records. Special categories may be present as a matter’s facts require; the firm decides what it stores.

3. Where

In the deployment and region the firm selected. EdgeLex does not move data between regions or deployments. For self-hosted and private-cloud deployments, EdgeLex holds no copy.

4. Subprocessors

Only those needed to run the service, each bound in writing to equivalent obligations and to no training on firm data, with 30 days’ notice of any change:

• EdgeLex’s own servers: infrastructure for the EdgeLex cloud edition. No third-party hosting provider holds firm data.
• AI model providers, currently OpenAI, Anthropic and xAI: only for models the firm’s policy allows, only for the calls the firm’s users or approved delegations make. Not used when the firm brings its own keys or runs local models.
• Stripe: subscription billing. Sees the firm’s billing contact, never matter data.
• Brevo: delivery of platform notification email. Sees the recipient address and the notification, never the matter.
• Free Law Project (CourtListener): citation verification queries, which carry the citation, not the matter.

5. Security measures

Encryption in transit and at rest; credentials encrypted with AES-256-GCM with per-credential IVs; tenant isolation; role-based access; comprehensive audit logging; legal hold and retention controls; daily backups; access to production by named staff only, logged. Details on the Security page and available for audit on request.

6. Assistance and rights

EdgeLex helps the firm answer data subject requests, complete impact assessments and respond to regulators, using the platform’s export, search and audit tools, at no charge for reasonable requests.

7. Breach notification

EdgeLex notifies the firm without undue delay, and within 48 hours of confirming a personal data breach affecting the firm’s data, with what is known, what is being done, and a named contact.

8. Return and deletion

On termination the firm exports its data in standard formats. EdgeLex deletes remaining copies within 30 days and confirms in writing, except where law requires retention.

9. Audit

Once a year, or after a breach, the firm may audit EdgeLex’s compliance with this addendum on reasonable notice, itself or through an independent auditor bound by confidentiality. EdgeLex provides its most recent security documentation first.

10. International transfers

Where personal data would leave its region, transfers rely on the Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies. Firms that want no transfer at all choose a deployment in their region or on their own infrastructure.

Questions: hello@edgelex.com.