Is My Data Safe with Lexi? Security Compared with Harvey and Lexis+ AI

Is my data safe with Lexi, and how does it compare?

Yes. Lexi, the AI paralegal in OpenLaw for Attorneys, keeps firm data under a SOC 2 Type II report. It encrypts data with AES-256 at rest and TLS 1.2+ in transit, and its contract bars anyone from training AI models on your content. Harvey and Lexis+ AI make similar no-training promises, so for most firms the real choice is about what job each tool does.

The verdict: Harvey fits large firms building out legal AI for drafting and analysis across many practice groups. Lexis+ AI fits firms whose main need is research tied to LexisNexis content. Lexi fits small and midsize firms that want an AI paralegal running intake, engagement letters, document collection, filings and billing inside their existing systems.

One disclosure: we build one of these tools. It gets one entry and one honest take, same as the rest. Every security claim below comes from the vendor's own published terms or security pages, which we read in October 2026. Prices were checked the same month.

One naming note: a separate company at getlexi.io also sells a legal AI product called Lexi, and some search results quote its pages. This article covers Lexi from OpenLaw, Inc., the AI paralegal in OpenLaw for Attorneys at lexi.law. The getlexi.io product has its own security claims, which you should check with that company directly.

What does Lexi actually do with my firm's data?

Lexi uses your data only to do the work you ask of it, and your firm keeps ownership. The Lexi Terms of Service and Privacy Policy from OpenLaw, Inc., both effective July 15, 2026, set out these commitments:

• Ownership: "As between the parties, Customer owns all right, title, and interest in and to Customer Content" (Terms, Section 9.1).
• No model training: Lexi "will not use Customer Content to train its own or any third party's foundation or general-purpose AI models" (Terms, Section 9.3).
• AI providers: Lexi runs on models from OpenAI and Anthropic. The privacy policy says these providers are contractually required to use your data "only to provide the requested service, and not for advertising or for training."
• Encryption: TLS 1.2+/1.3 in transit, and AES-256 at rest with cloud-provider key management.
• Retention: Customer content is deleted within 30 days of account closure, unless the law requires otherwise. Encrypted backups age out on a rotation of about 35 days.
• Sharing: Lexi does not sell customer content or use it for advertising. Subprocessors such as Google Cloud are bound by contracts that limit them to providing the service.
• Firm IP: Skills and workflows your firm builds into Lexi are visible only to your firm. Other firms, your clients and AI labs cannot see them.

Lexi also holds an issued SOC 2 Type II report and keeps an audit trail linking each output to its source data. To learn what to ask for when you request a SOC 2 report, read SOC 2 Compliance for Legal Tech: What Law Firms Should Demand.

Does using an AI tool waive attorney-client privilege?

Not if the tool keeps your data confidential and you use it under a lawyer's direction. The risk comes from consumer AI products whose terms allow disclosure of your data or training on it.

In United States v. Heppner, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York ruled from the bench on February 10, 2026. He held that documents a criminal defendant created with the consumer version of Anthropic's Claude were not protected by attorney-client privilege or the work product doctrine. His written opinion followed on February 17, 2026. A key reason was the consumer privacy policy, which allowed disclosure of user data and training on user inputs, so the defendant had no reasonable expectation of confidentiality. The defendant also had not used the tool at counsel's direction.

Commentators, including Proskauer, note that the ruling leaves open whether enterprise tools could lead to a different result. Those are tools that exclude user data from training and carry contractual confidentiality protections. All three products here are sold on those terms. Still, no court has ruled on any of them, so treat contract terms as support for privilege, not a guarantee.

What does ABA Formal Opinion 512 require?

The ABA's Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024), lists your duties when you choose a vendor. Before you enter client information, you should review the tool's privacy policy, terms of use and contract terms. Self-learning tools that could expose one client's information to others require the client's informed consent. The opinion says general boilerplate in an engagement letter is not enough. A tool that contractually bars training on your data lowers that risk, but you still owe the duties of competence and supervision.

How does Lexi vs Harvey vs Lexis+ AI pricing compare?

None of the three publishes a price list, as of October 2026. Each one quotes after a sales conversation, so the figures below are reported numbers or published policies, not rate cards. Treat any number as a starting point for negotiation.

Harvey's published pages show no pricing. A June 2026 roundup by eesel AI collects reports of about $1,200 per seat per month for the base tier and $2,400 when bundled with LexisNexis. It also reports a 20-seat minimum on 12-month contracts, which comes to roughly $288,000 a year. These figures come from community reports, not from Harvey. LexisNexis prices Lexis+ with Protégé on request. Lexi is quoted after a demo, based on firm size and the workflows you automate.

Where do Harvey and Lexis+ AI still win?

Each competitor beats Lexi at certain jobs, and a fair comparison should say which.

• Harvey: It has the broadest third-party certification stack of the three: SOC 2 Type II plus ISO 27001, 27701 and 42001. It offers data residency in the EU, Switzerland, the US and Australia, and its penetration testing is done by outside firms such as NCC Group and Bishop Fox. For a global firm with cross-border residency needs or an ISO-only procurement checklist, Harvey is easier to approve.
• Lexis+ AI: It is built on LexisNexis's own case law and secondary sources, and third-party models run in LexisNexis's private cloud. If research with citable authority is your main AI need, it belongs on your shortlist.
• Lexi: It wins where the work is operational rather than analytical. That includes intake recalls, engagement letters, document collection, filing prep, client messages and payments, connected to tools like Clio Manage and Google Calendar. What Lexi Replaces walks through the stack it consolidates.

Can firms use both Lexi and Harvey or Lexis+ AI?

Yes, and many firms will. The tools sit at different layers. Harvey and Lexis+ AI help lawyers draft, analyze and research. Lexi runs the firm's operations around that work.

A common pairing is Lexis+ AI for research and Lexi for intake-to-invoice operations. Lexi already connects to research tools such as Thomson Reuters. Running two vendors means two sets of terms to review under Opinion 512, so keep each vendor's SOC 2 report and data terms on file. If you are weighing a similar pairing with Legora, see Legora vs Lexi for Law Firms.

Which should you choose?

Pick by the job you need done. All three make the same core data promise.

• Choose Harvey if: you are a large firm or legal department and you need ISO certifications, data residency outside the US, and a drafting and analysis platform for many practice groups. You should also be able to budget for reported multi-seat annual minimums.
• Choose Lexis+ AI if: research and citation are your main AI needs and your firm already works in LexisNexis.
• Choose Lexi if: you run a small or midsize firm whose bottleneck is staff time on intake, documents, filings and billing. You also want contractual no-training terms and a SOC 2 Type II report.

Whichever you choose, do the same checks. Read the vendor's current terms and privacy policy, request the SOC 2 report, confirm how model providers are bound, and decide whether your clients need to be told or asked for consent. How to Choose the Right AI Tool for Your Law Firm has a full evaluation checklist.