Security and privacy at LetX
What we do to protect your documents, where they are stored, and what we do not have yet. Written for students and labs, and for the people who approve software at universities.
Where your data is stored
The database, your files and the servers that run LetX are on Amazon Web Services in the Asia Pacific (Mumbai) region. The web app and public pages are delivered through Cloudflare. Every company that processes data for us is named in the privacy policy, with what it does.
Who processes your data
| Company | What it does for LetX | When |
|---|---|---|
| Amazon Web Services | Servers, file storage, the database, and the emails LetX sends | Always |
| Cloudflare | DNS, and delivering the web app and public pages | Always |
| Google Cloud (Vertex AI) | The AI model behind Lexi and the other AI features. Its terms prohibit training on customer data | When you use an AI feature |
| Google and GitHub | Signing in | Only if you sign in with them |
| Google Fonts | The typefaces on letx.app, downloaded by your browser | When a page loads |
| Zoho | Our business email and support inbox | When you write to us |
| Lemon Squeezy | Merchant of record: payment, invoices, and sales tax or VAT | Only if you buy a paid plan |
The database, your files and the servers are in the AWS Asia Pacific (Mumbai) region. AI requests go to Vertex AI’s global endpoint, which can serve a request from any of Google’s regions rather than one fixed region.
Encryption and access
- Everything between your browser and LetX travels over HTTPS.
- The database and stored files are encrypted at rest.
- Passwords are stored only as hashes.
- Your files are served through private, signed links, not public addresses.
- Projects are private by default: only people you invite, or anyone you send a share link to, can open them.
- The database has automated backups and is protected against deletion.
AI and your documents
Your documents are never used to train AI models, ours or anyone else’s. Text goes to the AI provider only when an AI feature runs: on the free plan, when you ask Lexi something; on paid plans, also for inline suggestions, which are on by default and can be switched off in Settings. Today that provider is Google Cloud Vertex AI, whose terms prohibit using customer data to train Google’s models, set to the strictest data-retention option it offers.
Export, retention and deletion
- You can download any project, source and files, at any time.
- When you delete your account, your personal data and documents are deleted or anonymised within a reasonable period; backups that still hold them expire on their own schedule.
- A document you send to prove academic status is deleted about a day after the decision.
- Billing records stay with Lemon Squeezy, our merchant of record, to settle refunds and disputes.
Signing in
People sign in with an email and password, or with Google or GitHub. On an Institution plan, anyone who signs up with a verified address on your university’s email domain joins your organisation automatically. SAML or OIDC single sign-on is not available yet.
What we do not have yet
- A SOC 2 report or an ISO 27001 certification.
- A standard data processing agreement.
- A completed security questionnaire such as HECVAT.
- An independent accessibility audit, so we do not claim WCAG conformance.
- SAML or OIDC single sign-on.
- A public status page.
If your procurement needs any of these, write to support@letx.app and we will tell you exactly where each one stands. For what an Institution plan includes, see LetX for universities and departments.
Reporting a security issue
Email support@letx.app. The same address is listed in our /.well-known/security.txt file. The changes you would notice, security fixes included, are dated in the changelog.