L

Lexroom

Lexroom's Libreria Lexroom is a curated collection of institutional legal sources organized into more than fifteen subject modules, each selected by legal institute and validated by partner jurists, and the commercial unit is access to those modules: the published entry plan buys one Lexroom module for one user. A curated legal database is a product that functions without any model, and it is what traditional Italian banche dati sell.

Lexroom also states plainly that it does not build its own large language model but uses third party AI. The AI is the mechanism the buyer pays for, layered on a document collection that would still exist without it.

Every answer is anchored to updated sources that can be verified and downloaded in one click, and every statement links to the original source so the user can open, verify and cite it, according to the research page. Source selection is described: thousands of legislative and case law sources, selected by legal institute and validated by partner jurists, across more than fifteen subject modules built and verified one at a time.

The privacy policy adds that Lexroom always provides the sources that justify the reasoning so the customer can check it. No accuracy figure, test set, benchmark or evaluation is published. The marketing makes an absolute claim in two places: zero hallucinations and zero risks, and on the research page, sources consulted without risk of hallucination.

Automated decision making under the GDPR is addressed directly in Lexroom's privacy policy. It states that outputs are always submitted to a human operator who must review them before use, so they are not automated decisions in the strict sense. Sources sit behind every statement so a user can verify before relying, the research page says the user decides rather than an algorithm, and the Word add in proposes changes inside the document rather than applying them.

Nothing states what any step completes without a human, what the system does when it is uncertain, or what happens after it is wrong.

Corporate customers include Satispay, Fastweb, Italgas, Mediolanum, CRIF, WST, MDV and Generali, and law firm customers include Withers, LCA and Gatti Pavesi. Four individuals speak on the record with name, role and employer, including Maddalena Malzanni, Legal Counsel Lead at Qonto, and Ferdinando de Martinis, Associate at Gitti and Partners. There are dedicated customer story pages for Qonto, Jet HR and Credem Banca.

Figures are published separately from the customers: 40 percent time saved on repetitive tasks, 2.5 times more documents drafted, and more than 15,000 legal professionals using the platform. Those are aggregate claims with no method, basis or attribution to any named firm, and nothing is dated.

A commitment to confidentiality in line with privacy law and with segreto professionale sits on the security page, and the privacy policy states that beyond privacy Lexroom protects professional secrecy and confidential information generally. An operational control is attached: efficiency monitoring data is visible to Lexroom staff only in anonymized form so that confidentiality and professional secrecy are not compromised.

Segregation is documented at tenant level. Each customer has a dedicated and exclusive virtual space, private library contents are not shared with other customers, and the privacy policy states it is physically impossible for one customer to reach another's. Google and OpenAI are named and contractually excluded from training on customer prompts. Lexroom itself may use prompts for its own benchmarking and fine tuning after stripping personal and confidential data. Matter level walls inside a single firm are not addressed, although law firms are a named buyer.

Under Lexroom's privacy policy, outputs are always submitted to a human operator who must review them before use, and the research page frames the product as amplifying professional judgment, with the user rather than an algorithm deciding. Coverage is bounded: the platform is stated throughout as available in Italy, Spain and Germany only. No statement that output is not legal advice is published, and the site publishes no terms of service in which such a statement would normally sit.

No bar or professional guidance is engaged: neither Italian Consiglio Nazionale Forense material nor any equivalent in Spain or Germany is named.

The security FAQ describes Lexroom as fully compliant with the GDPR and the new European AI Act. The privacy policy contains a reasoned analysis of automated processing under Article 22, concluding that outputs are not decisions in the strict sense because a human must review them. A Data Protection Officer is named in full, with chambers, tax code and certified email address, though the role covers data protection rather than model behavior.

There is no governance framework, no owner of model behavior, no account of what is tested before release, and no certification such as ISO 42001. Nothing is published about uneven output across matter types, parties or populations.

Private library files are deleted within 30 days of the end of the relationship, and backup copies on Google Cloud within at most 180 days. Prompts are kept for the duration of the relationship, and customer registry and billing data for ten years under Italian accounting law. Deletion follows the same clock, and data subject requests are answered within 30 days. Data access is limited to a small number of technical staff with special authorizations, with all access and downloads monitored, an enforced password policy, encrypted stored passwords and single sign on over SAML and OAuth 2.0.

Google and OpenAI are named as the AI providers, other recipient categories are listed, and a software bill of materials is available on request. A formal emergency procedure provides notification to the customer as soon as possible by certified email or another agreed secure channel. Encryption is AES 256 at rest with a bring your own key option, vulnerabilities are scanned daily, and external penetration tests run with summaries available on request.

Nothing published states who bears the loss when the output is wrong. No terms of service, master agreement or customer contract appears on Lexroom's site. The footer offers only a privacy policy and a cookie policy, and the privacy policy describes the data processing agreement as signed at contract activation rather than published. No indemnity, liability cap, warranty or carve out is stated. Lexroom states that it holds cyber risk insurance with a carrier rated double A by Standard and Poor's, with a copy of the certificate available on request, and that a service level agreement is attached to the corporate plan contract. Neither sets out recourse for a wrong answer; the insurance covers Lexroom's own exposure.

Data flow through the Microsoft Word add in is set out rather than merely named: the privacy policy states that the add in involves no additional data processing and that prompts formulated through it are directed straight to Lexroom without retention by or access from Microsoft or any other intermediary. Single sign on is specified by protocol, compatible with Google and Microsoft accounts and with SAML and OAuth 2.0.

No document management, practice management, email or electronic filing integration is named, no API or developer documentation is published, and no integrations page exists.

All data are processed on servers located exclusively in the European Union, the security page states, with the principal server in the Netherlands and backup redundancy across several EU data centers against extreme weather. The privacy policy adds that Lexroom keeps data long term on servers within the European Union. It discloses the one exception precisely: limited transits to the United States for website hosting only, covered by EU standard contractual clauses and the Data Privacy Framework.

The tenancy model is stated, with each customer given a dedicated and exclusive virtual space, and a bring your own key option is offered for encryption. Lexroom operates no data center of its own and relies on cloud services listed in the Italian national cybersecurity agency's digital infrastructure catalog. There is one region and no option outside the EU.

Certification to ISO 27001:2022 is in place. External penetration testing is stated, with auditors described as external and a summary report available on request. Daily vulnerability scanning is described with findings classified and prioritized, and a software bill of materials and a cyber insurance certificate are each offered on request. No auditor is named, no certificate number, issue date or coverage period is published, and no report is downloadable. A trust center at trust.lexroom.ai is linked from the footer and the security page.

Lexroom's privacy policy states plainly that Lexroom does not develop its own large language model but relies on third party artificial intelligence, and that the service therefore transfers data to its suppliers, in particular Google and OpenAI. It adds a contractual commitment about what those providers may do: customer prompts are expressly excluded from the AI suppliers' training under the terms agreed with them as subprocessors.

Where inference runs is addressed at the level of the estate rather than the route, with all processing on EU servers. No model is named, only the companies they come from, and nothing commits to notifying customers when the supply chain or the models change.

Pricing starts at 99 euros per month, excluding VAT, on an annual contract. That buys one Lexroom module, one user, up to 200 documents, the Microsoft Word add in, and the possibility of tailored training: a rate, a unit and a term. Above the entry plan, prices are tailored to requirements, so the enterprise range is a sales conversation. Nothing states what implementation or tailored training adds. No module is priced individually, although modules are the unit of purchase. There is no pricing page as such; the figure appears in a demo booking block repeated across the site.

Lexroom gives seven segments their own page: law firms, companies and public administration on the organization side, and advocates, notaries, accountants and labor consultants on the professional side, which covers private practice, in house and government use explicitly. Jurisdiction is bounded and repeated on every page, with the platform stated as available in Italy, Spain and Germany. Subject coverage is counted rather than listed: more than fifteen subject modules are said to exist, each built and verified individually, and modules are the unit a customer buys, but they are not named. No statement of firm size or of what the product does not support is published.