The application
The web application runs on a server in Dubai too (since 16 October 2026), so requests are handled in the UAE; firm data passes through it and is not stored there.
Security · UAE data residency
Fully hosted in the UAE, and exactly what that covers.
When a bank, a government client or your own compliance team asks where client data lives, this is the answer we would put in writing: what runs in Dubai, what leaves the UAE and when, and what we do not have yet.
What runs in Dubai
Lexorii is fully hosted in the UAE: the application, the firm database, files and every backup run on servers in Dubai.
The firm database and files
Held by Ultahost on a server in Dubai. Firm data is encrypted at rest: the database server in Dubai runs on a fully encrypted disk (LUKS2, AES-256), and backups are encrypted before they leave it.
Backups every 15 minutes
Every 15 minutes, encrypted backups go to a second, separate provider in Dubai. They are encrypted before they leave our server, so that provider cannot read them, and a restore is tested automatically every month.
Who inside the firm sees what
Access by role, so lawyers, accountants and partners each see their own part. A firm can require two-factor sign-in for every staff account, document activity is kept in an audit trail, and deleted records can be recovered for 60 days.
What leaves the UAE, and when
What leaves the UAE is limited to what a feature needs: requests to the AI model when someone uses an AI feature, notification emails that carry no client details, push notifications to phones, and any calendar or accounting service a firm chooses to connect.
| What | Provider | Where | When, and what it receives |
|---|---|---|---|
| AI features (the assistant, drafting, translation, meeting transcripts) | Anthropic (the Claude model) | United States | Only when someone uses an AI feature. It receives the request and the records looked up for it, which can include client information. Not used to train models; kept up to 30 days. |
| Notification and account email | Resend | United States and EU | Every notification email. It carries a short line and a link back to Lexorii, with no client or matter names, documents or amounts. |
| Push notifications to phones | Expo, Apple and Google | United States (Expo), then Apple’s and Google’s networks | For staff who turn notifications on. By default a push says only what kind of update is waiting. |
| Error reports | Sentry | EU (Frankfurt) | When something fails. Scrubbed of names, emails, request contents and client data. |
| Services a firm chooses to connect | Google, Microsoft, and others the firm enables | Where that provider runs it | Only after the firm connects them: calendar sync, and tasks from forwarded email where a firm turns that on. |
| Standby copy of the web application | Vercel | Frankfurt | Only if we have to switch back while the move to Dubai settles, until about November 2026. Named in our privacy policy. |
Our domain name service (Cloudflare) points browsers to the server in Dubai; app traffic does not pass through it. The full list of providers is in the privacy policy.
What we do not have
A page like this is only useful if it says where we fall short.
- No ISO 27001 or SOC 2 certification. We hold neither today, so if your procurement requires one, we are not the right choice yet.
- The AI model runs in the United States. A firm that uses AI features sends those requests to Anthropic.
- Not on-premise. Lexorii is a cloud service run by us; it cannot be installed on your own servers.
How vendors compare on hosting
Legal software sold in the UAE is hosted in very different places. Each line below is what the vendor’s own website said on 16 October 2026, with the page linked. Vendors that do not state a location are not listed; ask them.
| Vendor | Where firm data is hosted | AI processing | Certification |
|---|---|---|---|
| Lexorii | Dubai: app server (LightNode), database and files (Ultahost) and backups (LightNode). | Anthropic, United States, when an AI feature is used. | None. No ISO 27001 or SOC 2 today. |
| CasEngine | Microsoft Azure UAE North by default: databases, documents and backups (privacy policy, clause 8.1). CasEngine privacy policy, CasEngine sub-processors | Azure OpenAI in UAE North where regional capacity permits, otherwise other Azure regions. Error reports go to Sentry, outside the UAE. | No certificate stated. Its policy says its security management system is aligned to ISO/IEC 27001. |
| Lexzur | Microsoft Azure. A UAE, Saudi or EU hosting region is offered and set in the Order Form; the pricing page lists Local Data Residency as “Contact Us”, and the homepage says it is available from the Business plan upward. On-premise is also offered. Lexzur pricing, Lexzur security and privacy, Lexzur homepage | Azure OpenAI. The region is not stated. | ISO/IEC 27001:2022 (certificate AE24060703), and SOC 1 and SOC 2 Type II audits. |
| Clio | Amazon Web Services, with hosting in the US, Canada, Europe or Australia. No UAE location is listed. Clio security, Clio sub-processors | AWS Bedrock (US or EU), Anthropic and OpenAI (US), per its sub-processor list. | SOC 2 Type II and SOC 1 Type II examinations every year. |
| LawSurface | Its privacy policy says data may be hosted or processed inside or outside the United Arab Emirates. LawSurface privacy policy | OpenAI, for AI features. | Says it applies ISO/IEC 27001:2022; no certificate details given. |
| Lawsyst | Its FAQ says data is kept in the UK unless agreed otherwise. Lawsyst FAQ | Not stated on the pages we read. | Not stated on the pages we read. |
The fuller comparisons, with prices and where each vendor is the better choice, are at Lexorii vs Lexzur, Lexorii vs Clio and Lexorii vs Vision Law. Names are trademarks of their owners. If a line here is out of date, email support@lexorii.com and we will correct it.
Questions to put to any vendor
Including us. Get the answers in writing.
- Which country holds the database, the files and the backups? Is that the default, or a region we have to request and pay for?
- Where does AI processing happen, and does it fall back to another region when capacity runs short?
- Which sub-processors receive our data outside the UAE, and what does each one receive?
- How often are backups taken, where do they go, and when was a restore last tested?
- Which certifications do you hold? Ask for the certificate number and its scope, not a logo.
Questions firms ask
Is Lexorii hosted in the UAE?
Yes. Lexorii is fully hosted in the UAE: the application, the firm database, files and every backup run on servers in Dubai. The web application runs on a server in Dubai too (since 16 October 2026), so requests are handled in the UAE; firm data passes through it and is not stored there.
Does any of our data leave the UAE?
Some does, when a feature needs it. What leaves the UAE is limited to what a feature needs: requests to the AI model when someone uses an AI feature, notification emails that carry no client details, push notifications to phones, and any calendar or accounting service a firm chooses to connect. The AI model is Anthropic’s, in the United States. Every provider is named in our privacy policy.
Do we have to use the AI features?
No. AI is an optional plan for the whole firm, and nothing else in Lexorii depends on it. Data goes to the AI model only when someone uses an AI feature.
Is Lexorii certified to ISO 27001 or SOC 2?
No. We hold neither certification today. We describe exactly what we run and where instead, and we will answer your security questionnaire in writing.
Does hosting in the UAE make our firm compliant with the UAE PDPL?
Not by itself. Where data is hosted is one of the questions the UAE PDPL, the DIFC and ADGM data protection laws and your clients’ contracts ask, and the answer here is a fact you can rely on. Whether it meets your firm’s obligations is for your firm and its advisers to decide; this page is not legal advice.
Why does your privacy policy still mention Vercel?
Until 16 October 2026 the web application ran on Vercel in Frankfurt. It now runs on our own server in Dubai, and a standby copy stays on Vercel until about November 2026 in case we have to switch back. Firm data was never stored there.
Partners who read Arabic can read this page in Arabic: الأمان واستضافة البيانات في الإمارات. What else Lexorii does for a UAE firm is on the law firm software UAE page.
2 months free
Bring your security questionnaire.
Book a demo and we will walk your team through where each part of Lexorii runs, and answer your firm’s or your client’s questionnaire in writing.