Investor overview
We are not the model.
We are the gate and the record.
Litigation AI for matters that cannot leave the building — and, for the ones that may, proof of exactly what left, to whom, and what was checked before a lawyer signed. Any frontier model, through one boundary enforced by the build rather than by policy.
Confidential overview — figures are plan, not results.
Pre-revenue. The boundary, the hash-chained audit log and a measured verifier exist; a pilot appliance ships. The de-identification layer — the gate to frontier models — is in development. Figures below are the plan, and the risks are listed with them.
The problem
Two liabilities, and the better the model, the larger both get
Fabricated or unsupported assertions (sanctions, Rule 11) and disclosure to a third party (privilege waiver, HIPAA). Frontier legal AI makes the first easier to commit at scale and the second the default path of least resistance. Nearly every vendor answers only the first — and by checking its own work.
A checker that checks itself is not a checker
Every vendor now ships a checker — and each checks the vendor’s own content in the vendor’s own cloud: Thomson Reuters’ Deep Research Verify tests assertions against Westlaw, Lexis’ Shepard’s Verify against Lexis. None checks the matter’s own record, and none is independent of the model that drafted. Independent measurement is sobering: 17–33% hallucination for the paid research tools (Stanford RegLab, 2024); lawyers themselves at 71% accuracy, the best tools at 79–81% (Vals AI, 2025). Nobody is at 100%, and the check has to live on the firm’s side of the line.
Zero data retention is a contract, not a property
Under oath the question is not “did the vendor keep it” but “did it go to a third party” — and for cloud AI the answer is yes. In February 2026 a federal court held a defendant’s chatbot memoranda neither privileged nor work product (United States v. Heppner, S.D.N.Y.); other courts have gone the other way, which is the point: the answer now depends on what the firm can prove about the tool. Matters under protective orders, sealed records, health information, criminal and immigration work cannot take that uncertainty.
The solution
One boundary, any model behind it, a record in front of it
LexVault does not compete with frontier models on drafting or research. It owns the matter, decides per matter what may leave, strips identity before anything does, checks everything that comes back, and keeps a record a court can read.
- The matter lives on the firm’s own machine — encrypted per matter, with a key the vendor never holds. Nothing in the product can reach the internet: the boundary is a fact of the dependency graph, checked on every build, not a setting someone can flip.
- What may leave is a legal decision, made per matter and recorded — fully local, or de-identified through the gateway. There is no default and no silent path.
- De-identification precedes any transfer — identifiers become stable placeholders; the mapping never leaves the host. Only one type can cross the boundary, and only the de-identification layer can construct it.
- Any frontier model, through one gateway — plain HTTP, no vendor SDK, so switching providers is an address and a header. GPT-6 Astra Law is a candidate the day its API ships; so is whatever beats it.
- Everything that comes back is checked on our side of the line — facts against the matter’s own documents with a verbatim quote, authorities against canonical registries, and a mandatory attorney gate. Anything unsupported is flagged [VERIFY]; nothing is filed or sent by the system.
- Measured, not claimed: on a twelve-claim controlled set from our synthetic matter, the verifier flagged both a planted $3,800 billing overstatement and a fabricated assertion, passed all ten sound claims, and backed every pass with a verbatim quote checked against the source. Local model, no cloud. Twelve claims is a first measurement, not a validated rate. The generator is deliberately not ours; the next measurement is the same verifier on a frontier model’s draft.
The record. A hash-chained, append-only audit log the database itself refuses to alter; a per-matter egress report that answers “what left, to whom, when”; a monthly anchor certificate; the fingerprint of the model that processed each matter. From these the product will print an AI-use attestation to attach to a filing — claims verified with quotes, authorities validated, transfers listed or none — the document courts with generative-AI standing orders are already asking for and no cloud vendor can issue about itself.
Why now
On 17 September 2026 the model became a commodity
OpenAI’s Astra for Law put a frontier model, a 230-million-document legal index and legal-writing instructions behind a Trusted Access programme for eligible firms, with 26 plugins reaching down to small-firm practice management. Research and drafting are no longer a place to compete. Two things did not ship with it and cannot: proof of non-transfer, and a verifier independent of the model.
The temptation is now universal; the gate is not
Every firm will be offered frontier quality in exchange for sending the matter out. The trusted tier is for Am Law 200 firms; everyone else gets the plugin. ILTA’s 2026 survey of 500+ firms: 94% use or explore generative AI, and generative AI entered the survey’s security-challenge list for the first time — straight into second place. Matters barred from the cloud do not become fewer because the model got better. What is missing is the instrument that decides per matter, records the decision, and proves it afterwards.
The hardware bet shrank
The local machine no longer needs to host a 120-billion-parameter drafter. It needs to run OCR, de-identification, the timeline stages that touch health information, and the verifier — small models on modest hardware. The frontier model sits outside the gate, paid for by the query.
Landscape
What the whales sell, and the square none of them stands in
Model vendors sell the model and the index. Legal publishers sell their content with a checker that checks that content. On-premises boxes sell a local model without the check or the record. Each is named below as its vendor describes it.
| Who | Where the matter goes | Who checks the output | What record the firm keeps |
|---|---|---|---|
| OpenAI — Astra for Law (17 Sept 2026) | OpenAI’s cloud. Trusted Access for Am Law 200 firms; zero data retention on the API by contract; API for builders “coming soon” | The lawyer. 54.0% of research questions pass the vendor’s own benchmark | None about non-transfer; the logs are the vendor’s |
| Thomson Reuters — CoCounsel Legal (20 Aug 2026) | Thomson Reuters’ cloud; agentic, built on Anthropic’s Claude Agent SDK | Deep Research Verify: whether cited Westlaw and Practical Law authority supports an assertion — the vendor against its own content; the matter’s facts are out of scope | Citation-backed results; no per-matter transfer record |
| LexisNexis — Lexis+ with Protégé (24 Feb 2026) | Lexis’ cloud; models from Anthropic, Google and OpenAI | Shepard’s Verify — Lexis against Lexis. 17% hallucination for its predecessor in the only independent study | — |
| Harvey, Legora | Their clouds, on GPT-6 Astra | The model, then the expert | — |
| Clearbrief — Cite Check Report (Dec 2025) | A cloud add-in to Word; the record is uploaded to Clearbrief | Legal and factual citations, with “classic” rather than generative AI — the closest thing to our verifier, and it lives outside the firm | A PDF of the check for the signing partner; nothing about what left |
| On-premises boxes (Zanus AI, Pocono AI and others) | Stays in the office | The local model’s own output; one vendor states it “does not guarantee attorney-client privilege protection” | Access logs; no verifier independent of the generator, no transfer record, no attestation |
| LexVault | Stays. Leaves only de-identified, per matter, by a recorded decision | A verifier independent of whichever model drafted: facts against the firm’s own record with a verbatim quote, authorities against registries, then the attorney | Hash-chained log, per-matter egress report, model fingerprint — and the attestation printed from them |
The empty square is on-premises and independent of the generator and a record of what left. Nobody above occupies it, and the demand for it is now written by courts and insurers rather than by us — see Compliance. We do not compete with any of them on research or drafting; any of them can sit behind the gate.
Sources. OpenAI, Astra for Law; LawSites on eligibility; Thomson Reuters press release; LawSites on Protégé; Stanford RegLab; Vals AI via LawSites; Clearbrief via LawSites; Pocono AI; Charlotin database; ABA Journal on Couvrette; ILTA 2026 via LawSites.
Compliance
Three shields
The architecture was not built first and checked against the rules afterwards — it was derived from them.
HIPAA
- Stages that touch health information run locally; PHI is never disclosed to any third party
- The gateway path runs only after de-identification, and for real PHI only under a signed BAA plus zero data retention — and the record shows which endpoint and which terms. OpenAI, by its own documents, signs a BAA only for the API and sales-managed Enterprise accounts; live web search is not BAA-covered
- Raw source documents never cross the boundary in any mode
Bar ethics
- Florida’s opinion draws our line for us: no informed consent is required when the AI “does not involve the disclosure of confidential information to a third-party”; for third-party AI, consent is recommended. Mode A is the first case; the whales are the second
- The per-matter mode decision is that consent record: what may leave, and why
- The lawyer “must verify the accuracy and sufficiency of all research performed by generative AI” and supervises it as a non-lawyer assistant (Rule 4-5.3)
Rule 11 / sanctions
- Since 15 June 2026 the signer of any document filed in a Florida court certifies that “all legal authorities exist and are accurately cited” (Rule 2.515, amended 28 May 2026, replacing the circuits’ patchwork of AI orders); a tracker counts 113 federal and state AI orders besides
- Every assertion grounded in a source file and page; every authority validated against a registry; claim-level verification to a verbatim-quotation standard, independent of the generator
- Mandatory attorney signature — and an attestation that shows the reasonable inquiry the rule now demands was actually made
Written by courts and insurers in 2026, not by us. Morgan v. V2X (D. Colo., March 2026): confidential material may go into an AI tool only under written contractual safeguards, and the party must keep documentation proving them before anything is entered — the court added that most mainstream, low-cost platforms likely cannot meet the standard. Jeffries v. Harcros (D. Kan., 2026) went further and barred open AI tools from all discovery material. WTW called January 2025 to January 2026 a “structural break” in professional-liability renewals; Aon’s underwriting questions are now “Do you use AI? Do you police it? Do you have protocols in place?”, and at least one carrier has filed a generative-AI exclusion naming ChatGPT. The egress report answers the first court; mode A answers the second; the record answers the underwriter.
Engagement letters disclose AI use expressly; the audit chain substantiates every claim made about it. Citations should be verified by counsel before use with a bar audience. Sources: Jones Day on Rule 2.515; Fla. Bar Op. 24-1; Kirkland on Morgan; Sidley on Jeffries; Jones Walker on Heppner; court-order tracker; insurance primary-source guide; OpenAI data controls.
Structure
The lawyer owns the practice
Two entities by design: a 100% attorney-owned PLLC that practises law, and a technology MSO paid in fixed, fair-market fees.
PLLC — practises law
100% owned by a licensed attorney- Owns every client relationship
- All legal judgement, case selection, fee setting and signatures live here
- Technology is staff, not a partner
MSO — sells infrastructure
Owns platform, hardware and IP- Co-owned by the operators; the attorney holds equity too
- Paid in fixed, fair-market fees only
- Never a percentage of legal fees; no participation in case decisions
The bright line — no fee splitting, no non-lawyer control. Follows Texas Ethics Op. 706 and Fla. Rules 4-5.4 / 4-5.7, and deliberately inverts every fact of the TIKD case: only the lawyer selects matters, sets fees and directs representation. Stated honestly: Florida has no MSO-specific opinion yet — an advisory opinion request is planned before scaling.
Business model
Three ways the gate earns
Sold on compulsion, not on taste: to the firms a court, a statute or an insurer forces to prove what left the building, and to the companies building on frontier legal models who need a check that is not their own.
The gate, as an appliance
- A preconfigured machine plus service for firms whose matters cannot leave: protective orders, sealed records, PHI-heavy personal injury, criminal, immigration, EU work
- Never a share of their recoveries
- Recurring revenue; the attestation is the reason to renew
The verifier and the record, for builders
- Legal-tech products built on frontier models need an independent verifier and an attestation format that is not the model vendor’s: Harvey and Legora build on Astra, CoCounsel on Anthropic’s agent SDK, and each ships a checker that checks its own content
- Runs where their data is; we license the checker and the record, not the matter
- One sale reaches many firms without selling to lawyers one at a time
The proving ground
- Personal-injury and employment matters in the owned practice — every matter proves the gate on real work, under real court scrutiny
- Revenue: standard contingency fees
- A de-identified outcome corpus by jurisdiction, judge and adjuster — codes, never names — that no model vendor holds
The plan
Twelve months to revenue-ready
Headline figures from the seed plan (August 2026); the milestones below are re-cut for the September positioning and the financials will be reconciled to them. The full P&L, hiring schedule and use-of-funds are available under NDA.
| When | Milestone |
|---|---|
| Month 1 | Entities formed and papered; insurance bound; pilot appliance installed at a first firm on test material; de-identification build started as the critical path |
| Day 90 | De-identification hardened; gateway to a frontier legal model live; first AI-use attestation printed on a synthetic matter |
| Months 3–6 | Two to three pilot firms with matters that cannot leave; first component conversations with legal-tech builders; authority validation against canonical registries |
| Months 6–9 | Hardware key sealing shipped — real matters become appropriate; bar advisory opinion requested; associate attorney onboarded |
| Month 12 | Pilot firms on live matters with attestations attached to filings; first component licence signed; first settlements arrive in the owned practice |
Risks
Stated plainly
Mitigations are implemented or budgeted, not promised.
| Risk | Mitigation |
|---|---|
| Platform | Model vendors will keep adding governance to their own clouds, narrowing the gap for matters that may leave — we anchor on what a cloud vendor structurally cannot offer: proof of non-transfer and a verifier independent of the model, and on matters barred from the cloud altogether |
| Regulatory | Florida has no MSO-specific opinion; an adverse reading is possible — met with strict fair-market papering, attorney control, and a pre-emptive bar advisory opinion request |
| Model dependence | The drafter is a third party; its terms, prices and eligibility rules are not ours — the gateway is provider-agnostic by construction (plain HTTP, no SDK), and the stages that must stay local run on local models |
| Adjacent players | On-premises boxes (Zanus AI, Pocono AI) sell a local model for a one-time price; Clearbrief sells a cloud cite-check with an audit PDF — we are the combination neither has, on-premises and independent of the generator with a record of what left; the component licence can run on their hardware as easily as on ours |
| Revenue timing | Contingency revenue is back-loaded and year one is capital-intensive even optimistically — recurring appliance and component revenue is the smoothing engine |
| Verification limits | No automated checker is ever 100%, and ours is measured on twelve claims so far — attorney oversight is structural, not optional: nothing is filed without a human signature, and the attestation states what was checked, not that it is correct |
| Build maturity | The pilot appliance ships the boundary, encrypted matter containers, the audit chain, backups with a rehearsed restore and signed offline updates; the reasoning agents are stubs by decision, because drafting moves outside the gate. De-identification is the critical path and is not yet production-grade |
Next step
A structure session and a live demonstration
The strongest close available is the one claim that can be tested in the room: a frontier model drafts, LexVault verifies, and the attestation prints — on a matter whose answer is already known.
Request the full deckFull P&L, hiring plan and use-of-funds are shared under NDA. Write to hello@lexvault.associates, or see the product overview for law firms.