Everything a buyer needs before signing — only what is true today.

LEXUN is a local-first static application. The decision engine — three released Monte Carlo models on a shared core — runs entirely in the browser; decision inputs, forecasts, outcomes and the personal audit trail are written to the device’s own storage, encrypted under a passcode-derived key. There is no LEXUN database of customer decisions and no upload endpoint. The only server-side component is a single serverless function that forwards optional assistant messages to a model provider. LIVE

The organisation workspace — accounts, members, roles, shared decisions, review and approval workflows, an organisation audit log and server-verified billing — is the hosted service, PLANNED · R2. Its architecture is set out in the engineering blueprint that ships with every release bundle and will be published here before it goes live. Nothing on this page describes it as existing.

Three flows leave the device, each named in the privacy notice and the security page: page requests to the CDN (standard request logs), the fields a person types into a form, and — only if the optional Copilot is used — the text typed into it or, when a person presses Explain, Challenge or Board summary under a result, the engine’s result summary (band, probability range, scenario percentages, input names and which are assumptions). No input figure, saved decision, Key or passcode travels on any flow.

In a founding pilot, evidence documents are exchanged through the customer’s own systems (shared drive or email at the customer’s choice) under a data-processing agreement; they are not uploaded to LEXUN infrastructure, because none exists to receive them.

Netlify, Inc. serves the site from a global CDN with primary infrastructure in the United States and the EU, stores form submissions, and runs the Copilot function. The deployment is a versioned static bundle; every release is retained as a numbered archive, so any version can be redeployed byte for byte. Environment secrets (the Copilot’s API key and the Stripe keys) are held in the hosting platform’s environment configuration, never in a file.

In transit: HTTPS on every page with HTTP Strict Transport Security. At rest, on the device: a saved Decision Record is encrypted with AES-256-GCM (96-bit nonce) under a key derived from the person’s passcode by PBKDF2-HMAC-SHA256 at 600,000 iterations, using the browser’s WebCrypto implementation. The passcode is never stored or transmitted; a forgotten passcode means an unrecoverable record, and the sign-up says so before it takes one. At rest, on our side: form submissions are stored by Netlify under its own encryption at rest.

There are no LEXUN accounts today, so there is no LEXUN account to compromise: access to a Decision Record is possession of the device plus knowledge of the passcode. Access to the hosting account and the form store is limited to the founder’s hosting account. Whether two-factor authentication is enabled on that account is verified as part of a customer’s security review and stated in the signed pack, not asserted on this page.

Roles and permissions for organisations (owner, approver, reviewer, challenger, read-only), invitation expiry and delegation are PLANNED · R2. SSO/SAML and SCIM are AVAILABLE BY AGREEMENT only once implemented and tested.

Every frozen decision carries a sealed receipt over its question, inputs, classifications, evidence versions, model and data versions, seed, band, challenge, reviews, approval, action, success criterion and resolution date; outcomes and evaluations are write-once. That is the audit trail that exists today, per record, on the device. LIVE An organisation-wide, action-by-action audit log with who / when / why / from-which-state on every transition is PLANNED · R2. Administrative actions on the hosted service will be audited from its first release.

Site: every release bundle is retained; recovery is redeployment of the last good bundle, which takes minutes. Customer decision data: it lives on the customer’s device and is backed up by the customer’s own export — the sealed .lexun JSON and the PDF Decision Record — which the pilot schedules at freeze. We cannot recover a record for a customer, because we never hold it; that is a limitation we state rather than a promise we cannot keep. Recovery objectives for the hosted service will be published with it.

Security reports are acknowledged within five working days. A personal data breach is handled as set out in section 13 of the privacy notice, including notification to the ICO within 72 hours where the UK GDPR requires it and to affected people without undue delay where the risk to them is high. Because no customer decision data is held by LEXUN, the realistic incident surface today is the form store and the hosting account, and the response plan is sized to that honestly.

Email hello@lexun.co.uk with “Security” in the subject; /.well-known/security.txt carries the same contact. We acknowledge within five working days and tell you what we did. No penetration test has been commissioned and no report exists; the release gate runs automated header, dependency-free and structured-data checks on every release, and the whole bundle is inspectable because it is static.

This is the complete list at the date of this page. Additions are published here and in the privacy notice before they process anything.

Decision data resides on the customer’s own device, in the customer’s jurisdiction, by construction. Form submissions and request logs are stored by Netlify in the United States; assistant messages go to Anthropic in the United States. We do not offer UK-only or EU-only residency commitments for those flows and will not imply one. Residency options for the hosted service will be published before it launches.

Organisation requests: 24 months from last correspondence, or the life of a resulting contract plus six years. Contact and waitlist submissions: 24 months. Server logs: the hosting provider’s own policy. Assistant conversations: not kept by us at all. Decision data on the device: until the customer erases it. The full table is section 7 of the privacy notice.

Personal data we hold is deleted on request to privacy@lexun.co.uk within 30 days and confirmed. Decision data is deleted by the customer on the device — the cookies page carries the erase control — and LEXUN has nothing to delete because it holds no copy. Organisation and account deletion rules for the hosted service (what is deleted, what is retained for legal reasons, and the timing) will be published with it.

Available on request and signed for the scope that exists: hosting logs, form submissions and, if used, assistant messages. It is drafted against the current architecture rather than a future one. When the hosted service ships, an expanded DPA with the full subprocessor list is published here first.

Stated plainly: LEXUN is founder-run. The mitigations are structural. The entire product is a static bundle that any competent engineer can redeploy from the retained archives; the models, tests, registries and release gates ship inside that bundle; the MCP server exposes the models to any client; and a customer’s records are exportable and verifiable without LEXUN’s involvement (/verify runs in the browser). Escrow of the release bundle is available by agreement for Enterprise customers and for Organisation-seat customers on an annual invoice.

Three models are released; nine are proposed and not released. A model is released by proof, not by interface: 711 automated checks, 96 frozen reproducibility results that must resolve unchanged, a mutation-tested contradiction engine over every public claim, and a public model registry with versions, lifecycle states and outcome-verification grades. No model, seed derivation or hash function changes silently; every change lands in the changelog with its version. Organisation-level model-approval controls (which versions an organisation permits) are PLANNED · R4.

The decision models are not machine-learning systems: they are seeded Monte Carlo simulations with published inputs, so the same inputs and seed reproduce the same result on any machine. The one AI component is the optional Copilot, which sends what a person types — and, on request, the engine’s result summary without the figures entered — to Anthropic’s API to produce a reply. Every number in a reply is checked against what the engine produced and any figure the model wrote on its own is removed before it is shown; the form is filled only with figures the person wrote; the system prompt forbids quoting an accuracy figure or giving regulated advice; the allowance is enforced server-side. No customer data is used to train anything, by LEXUN or, under its API terms, by the provider.

• No certification. Controls are designed with reference to Cyber Essentials and ISO/IEC 27001 principles; no certification, SOC 2 report or penetration-test report is held.
• Single-user, local-first today. Team features, roles, approvals and an organisation audit log are planned, and delivered by people in the pilot.
• No SSO, SCIM or uptime SLA. Offered by agreement only once implemented and tested.
• Form data resides in the United States. No UK/EU residency commitment for that flow.
• Founder dependency. Mitigated structurally (retained bundles, exportable records, escrow by agreement), not eliminated.
• Records cannot be recovered by LEXUN. A lost device without an export, or a forgotten passcode, means a lost record.
• ICO registration ZC183768. CA Capital Limited is on the ICO public register as a data controller (registered 27 June 2026, renewal due June 2027).