Security, data residency and the DPA — plainly.
LEXUN's honest security advantage is architectural: by default your decision data never reaches us, because analysis runs in your browser and is stored on your device. This page states exactly what that means, what our infrastructure does process, and what we can and cannot yet sign.
Architecture
- Local-first processing — the simulation engine runs entirely client-side. Inputs, forecasts, outcomes and the audit trail live in your browser's local storage. There is no LEXUN database of user decisions. A LEXUN Key does not gate the engine: running a decision needs no Key and no account. The Key gates the record — it is the passcode that encrypts a saved decision on your own device. LIVE
- One named exception, not a quiet one — the optional Copilot is the only feature that transmits decision-framing conversation text to a third-party model provider — and, when you press Explain, Challenge or Board summary under a result, the engine’s result summary (band, probability range, scenario percentages, the names of your inputs and which are assumptions, the decision question as you wrote it and the horizon in months), none of the financial figures you entered. It is not the only thing that transmits typed content at all: the contact form, the waitlist and the Key email sign-up each send exactly the fields you put in them, and each appears in the table below. It is listed in the server-side table below with its processor, location and purpose, and it carries the same warning above its own text box. Everything else on this site works without it. LIVE
- Encryption at rest, on your device — creating a LEXUN Key encrypts that record with AES-256-GCM (96-bit nonce) under a key derived from your passcode by PBKDF2-HMAC-SHA256 at 600,000 iterations, using the browser's own WebCrypto implementation. The passcode is never transmitted and never stored, so an unlock is a real decryption rather than a check we could remove — and neither we nor anyone holding the ciphertext can reverse it without your passcode. The corollary is blunt: a forgotten passcode means an unrecoverable record. LIVE
- Transport security — all pages served over HTTPS with strict transport security. LIVE
- No third-party trackers — no advertising pixels, no cross-site cookies, no third-party analytics scripts. The full storage-key inventory is in the Cookie Policy. LIVE
What is processed server-side today
| Data | Processor | Location | Purpose |
|---|---|---|---|
| Standard web-server logs (IP, user-agent, request path) | Netlify, Inc. (hosting/CDN) | Global CDN; primary infrastructure in the US/EU | Serving the site; security; reliability |
| Waitlist email address (only if you submit the form) | Netlify Forms | US/EU | Emailing you about launches, with consent |
| LEXUN Key sign-up: email address and a yes/no marketing choice (only if you create a Key). Never the passcode, the derived key or the encrypted record. | Netlify Forms | US/EU | Contacting you about the Key; marketing only if you ticked the box |
| Contact form submissions (only if you submit the form) | Netlify Forms | US/EU | Answering your enquiry |
| Assistant messages — the text you type into the optional assistant on the dashboard sign-in screen, plus that conversation's earlier replies. Never your email, Key, passcode, encrypted record, or any input figure. What does go, and only when you use a feature that needs it: what you type, and — for Explain, Challenge and Board Summary — a result summary made of the band, the probability range, the scenario percentages and the names of your inputs with which are assumptions. Never the numbers behind those names. A build check reads the shaped context the code actually sends and fails if it ever gains a field for an input figure. | Anthropic PBC, via a Netlify serverless function that holds the API key and forwards the request | United States | Producing the assistant's reply, and nothing else. Not stored by us; not used to train Anthropic's models under its API terms. |
That is the complete list. Note the fourth row, added on 30 July 2026: it is the only route by which anything you type reaches a third party, and it is the only one you can decline simply by not using a feature. The row is here rather than buried because the whole point of this page is that the list is complete.
Where the API key lives. Calling a model needs a secret key, and a static site cannot hold a secret — every file in this deploy is downloadable by anyone. So the key is not in this site's files. It is set as an environment variable on the hosting platform and read at request time by the function, which never returns it, never logs it and never sends it to the browser. If it is absent, the assistant says so plainly and the rest of LEXUN carries on working, because the rest of LEXUN needs no server.
Data residency
Honestly stated: your decision data resides on your own device, in your jurisdiction, by construction. The things that travel are what you type into the optional Copilot and, if you ask it to explain, challenge or summarise a result, that result’s summary without your figures; both go to the United States and are covered in the table above. No input figure, saved decision, Key or passcode travels with them. Static site assets are served from a global CDN. We do not currently offer UK-only or EU-only hosting commitments because we do not host user decision data at all; if future sync features change this, residency options will be published here before launch, not after.
Data Processing Agreement
For organisations that require a signed DPA under UK GDPR Article 28: because LEXUN does not process your decision data server-side, a conventional controller–processor DPA covers only the narrow scope above (hosting logs, form submissions and, if your people use it, assistant messages). We will provide and sign a DPA reflecting that scope on request — email hello@lexun.co.uk. When hosted sync and team features ship, an expanded DPA with the full sub-processor list will be published on this page first. ON REQUEST
What we will not claim
No SSO, no SOC 2 report, no penetration-test certificate exists today, and we won't imply otherwise — capability status is tracked openly on the Organisations page. A security claim you cannot verify is worth exactly as much as an accuracy claim you cannot verify.
Reporting a vulnerability
Email hello@lexun.co.uk with "Security" in the subject. We commit to acknowledging reports within 5 working days.