Home > LexisNexis Protégé™ in PatentSight+™ Security Information LexisNexis® PatentSight+™ with Protégé™ Security Information Your data Application Security Program Policies, Standards and Guidelines Architecture of Protégé in PatentSight+ Q&A Contacts Other Materials Trust, transparency and security: our promise LexisNexis® prioritizes security and customer data protection throughout the entire product development lifecycle. To ensure comprehensive security controls, our application and security experts work with product development, engineering and data protection teams. PatentSight+ with Protégé combines trusted patent data, proprietary portfolio valuation metrics including the Patent Asset Index, and structured patent analysis. PatentSight+ includes AI-Powered Analysis Builder and AI-Powered Insights to support its analysis workflows. Protégé is the generative AI assistant within PatentSight+ that helps users begin with a business question and develop and validate their analysis using PatentSight+ search, analytics, visualization and reporting capabilities. This overview answers common questions about how LexisNexis protects customers and their data when they use PatentSight+ with Protégé. The measures described here reflect our practices as of October 2026. As security procedures, regulations and threats evolve, LexisNexis may update technical, organizational and physical measures without notice, provided the changes do not materially lower the protection of information or materially depart from the protections described here. Your data Customer information in PatentSight+ with Protégé is protected by access-control and data-handling practices and encrypted in transit using TLS 1.2 or higher and at rest using AES-256. For AI-Powered Analysis Builder and AI-Powered Insights in PatentSight+, inputs and outputs are isolated from other customers and are not used to train third-party models. Processing for these features follows applicable service and privacy controls, with retention and auditability handled according to relevant product and enterprise requirements. For Protégé in PatentSight+, customer data is securely stored in our private cloud. Your prompts Each customer request or “prompt” is processed separately, creating an isolated transaction with the generative and analytic capabilities. Prompts are securely retained for up to 90 days (or until deleted by the user) to support transparency, auditability, and responsible model governance. All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to stored prompts is strictly limited through role-based controls and multi-factor authentication, with every access event logged and monitored. The retention environment is isolated, continuously monitored for anomalies, and regularly audited against ISO 27001 standards. Cloud providers may log in for system support and troubleshooting purposes only and have no access to user prompts. Your conversation Conversations are purged after 90 days or until the user deletes them (whichever occurs first). All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to stored prompts is strictly limited through role-based controls and multi-factor authentication, with every access event logged and monitored. The retention environment is isolated, continuously monitored for anomalies, and regularly audited against ISO 27001 standards. Cloud providers may log in for system support and troubleshooting purposes only and have no access to user prompts. Privacy LexisNexis processes personal data in compliance with data protection laws, our Privacy Policy, and Data Processing Addendum. We process personal data solely to provide the services listed on our Subprocessors page We incorporate privacy requirements into how we deliver and operate PatentSight+ with Protégé. Business contact, account, authentication, support and audit information may be processed as needed to provide, secure and support the service, subject to applicable legal and contractual requirements. Product-specific privacy, data-processing, subprocessor and service commitments are defined by the applicable agreement and order documentation. Privacy Policy Data Processing Addendum Subprocessors page Vulnerability scanning We perform penetration testing using internal tools and trusted third-party firms to validate our defenses. Regular internal and external vulnerability scanning helps maintain visibility into potential risks across our systems and hardware. Findings are tracked centrally to ensure proper risk prioritization, and remediation efforts are coordinated with the supporting teams based on risk severity. Application security program Risk-based application security testing for PatentSight+ with Protégé includes secure code review. Findings are prioritized for remediation according to severity and risk, with supporting evidence handled through approved customer-assurance channels. Security requirements are incorporated into the product lifecycle, release governance, vulnerability management and operations. Documented configuration, testing, approval and release controls govern production changes; security and operational events are logged and monitored as applicable to support traceability, review and timely response. Application testing Protégé in PatentSight+ code undergoes static application security testing (SAST) prior to being deployed to a live environment. Software composition analysis (SCA) is performed as part of the CI/CD pipeline to identify and manage third-party and open-source components within our software. Dynamic application security testing (DAST) scanning and penetration testing are also performed on the solution. Penetration test reports are available to customers upon request. Further application security questions can be addressed for customers under a non-disclosure agreement (NDA). Security gates are in place to prevent insecure code from being introduced to production. The application security team works with development teams to resolve vulnerabilities regardless of the source, in accordance with established remediation timelines based on criticality. Figure: The development lifecycle provides context for the application security testing and controls described above. Authentication We offer two authentication options. LexisNexis® PatentSight+™ uses its own Web Access Management (WAM) system for user authentication and also supports federated Single Sign-On (SSO) using SAML 2.0. Our technical support team will assist during onboarding with the SSO setup. Access permissions in PatentSight+ with Protégé follow least-privilege, need-to-know and role-based principles and are reviewed periodically. Multi-factor authentication and federated identity controls may be applied through customer identity providers and enterprise access-management processes where supported. Network security controls Network security controls are implemented based on a least access principle. The controls also provide protection against unauthorized access and traffic interception. These protections are in place to restrict access inbound and outbound along with internal traffic to/from systems. Where possible and necessary, private endpoints are utilized to securely access cloud services to ensure security of associated transactions. Secure or private service connectivity is used where appropriate for PatentSight+ with Protégé. Our own network access LexisNexis employees’ access to company networks is restricted to corporate managed devices and uses multi-factor authentication. Authorizations are based on the least privilege principle. Privileged accounts are provided based on the need to perform job function and approved by management, with regular access reviews undertaken. Access is automatically removed upon termination. Our corporate security practices cover asset management, acceptable use, personnel security, email protection and security governance. Personnel have confidentiality and security responsibilities. Corporate-managed devices use endpoint-protection controls; where applicable, portable devices are subject to encryption, remote management and loss-or-theft reporting requirements. Bring-your-own-device access to company networks is not supported. Data analytics LexisNexis allows access to data only by authorized support personnel with permissions on a need-to-know basis (principle of least privilege). LexisNexis gathers analytical statistics regarding usage of application functions but does not process any customer data specifically. Third parties The LexisNexis Vendor Management program performs vendor security checks and assessments during the procurement process. Initial approval is followed by a periodic review of the vendor’s security posture. Vendors are assessed on a risk-based approach using several factors including access to data (customer/company), system access, and performing a critical function on behalf of the company. We identify, assess, track and treat security risks affecting PatentSight+ with Protégé through risk-based processes. Supplier dependencies and security posture are considered as part of those processes. Policies, standards and guidelines LexisNexis has strict company-wide security policies, standards and guidelines that detail the necessary security controls and configurations that ensure all systems and data managed by LexisNexis remain secure. These policies are reviewed and updated regularly, considering changes in legal, regulatory, and operational environments, as well as to address new and emerging threats. Employees are required to complete computer-based training upon hire and periodically thereafter covering topics to include our security policies and practices, code of ethics, and data privacy. Relevant personnel also receive role-based secure-development or technical training. Internal policies address information security, access control, data handling, incident response, vulnerability management and secure development. Full internal policies are generally not distributed externally; approved summaries or evidence may be provided through customer-assurance channels. Our personnel operate under LexisNexis and RELX ethics and corporate-responsibility requirements. Enterprise controls address anti-bribery, fair competition and modern slavery. Robust incident response LexisNexis has a robust set of Information Security policies. This enables us to efficiently respond to potential threats against our systems. Our incident response plans, which are updated and tested periodically, include technical, administrative, business, and executive escalation processes. The company has external firms on retainer to provide expertise and guidance, as needed. Our documented incident-response processes cover detection, investigation, containment, escalation, recovery and lessons learned. Customer-notification obligations are managed under applicable contractual, legal and regulatory requirements. Business continuity and disaster recovery Business-continuity, backup, recovery and disaster-recovery practices support PatentSight+ with Protégé. Plans and recovery processes are reviewed and tested at least annually. Recovery objectives are service-specific or contract-specific where applicable. Audit reports We operate consistent policies and controls across our product space. ISO/IEC 27001 certification The ISO/IEC 27001:2022 certificate for our information security management system is held by Reed Technology & Information Services LLC and covers the collection, processing and storage of data-related information for commercial products in its Intellectual Property and Life Sciences business lines. PatentSight+ is covered within this organizational scope. We do not currently include Protégé in PatentSight+ in the Statement of Applicability. Annual security audits We operate consistent policies and controls across our product space. Our cloud environments, key products, and security programs are audited annually with focus on various controls in place for customer data protection, including: Our cloud environments, key products, and security programs are audited annually with focus on various controls in place for customer data protection, including: Encryption controls Data backup Disaster recovery Security groups utilized to assign role-based access privileges and segregate access to data User access reviews to ensure access is restricted and authorized Data destruction controls Blocking suspected or actual network breaches Maintaining confidentiality of customer data Data & infrastructure security PatentSight+ hosting PatentSight+ uses AWS for its hosting environment. Its cloud controls include access management, logging, monitoring, vulnerability management, backups, configuration management and change management. Protégé infrastructure Protégé in PatentSight+ is deployed and maintained using LexisNexis infrastructure, following the same security architecture, reviews, audits, and validation processes applied to other LexisNexis products including Lexis+ AI. Generative and agentic AI capabilities have been engineered and deployed to meet our high-level security standards, with a key focus on protecting and segmenting customer activity. Our security team continues to be actively engaged in all aspects of the engineering and deployment of Protégé in PatentSight+. Architecture of Protégé in PatentSight+ High-Level Architecture Flow: A user logs into the Protégé in PatentSight+ using WAM to securely access the application. All user prompts are sent securely using TLS 1.2 or later to PatentSight+ AI service. PatentSight+ AI service parses the prompt for intent and then constructs a PatentSight+ Search Syntax statement using an LLM. An authenticated request is sent securely using TLS 1.2 or later to LNIP API using the generated PatentSight+ Search Syntax. PatentSight+ AI service processes the returned results by performing a sanity check, analyzing them, preparing visualizations, and utilizing an LLM before returning them to Protégé in PatentSight+. All interactions within PatentSight+ AI service are securely recorded and encrypted at rest within conversation history for up to 90 days or until deleted by user. Anthropic and OpenAI LLMs are utilized with a zero data retention policy but are isolated from PatentSight+ AI service. Q&A What encryption standards apply to PatentSight+ with Protégé? Customer data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Are inputs and outputs from PatentSight+ AI-Powered Analysis Builder and AI-Powered Insights used to train third-party models? No. Inputs and outputs from AI-Powered Analysis Builder and AI-Powered Insights are isolated from other customers and are not used to train third-party models. Will my entries into Protégé in PatentSight+ be used to train large language models? LexisNexis does not use customer data to tune or train our Large Language Models. Users also have individual control of prompt history and options to delete prompt history from our services. For further information, you can access our privacy policy page. Can LexisNexis employees see my Protégé chat queries? Access to stored prompts is strictly limited through role-based controls and multi-factor authentication, with every access event logged and monitored. A restricted group of product support experts with appropriate access may review customer usage data for product support and technical troubleshooting. Access is limited to authorized personnel, and the customer association is pseudo-anonymized. Is my Protégé data made available to other services within LexisNexis? Customer data is only used and stored within the specific product context in which it was entered and is not shared with other LexisNexis products unless explicitly granted and communicated. Where can I request further security information for PatentSight+ with Protégé? Please contact your account team to request approved security-assurance materials. Availability of specific documents may be subject to confidentiality requirements. Contacts [email protected] Other Materials LexisNexis Legal & Professional Data Privacy Principles Responsible Artificial Intelligence Principles at RELX Your Peace of Mind Is Our Priority LexisNexis Privacy Policy For security requests, vendor forms and RFPs, use the LNLP Customer Request Form. In-depth InfoSec Documents: Available Upon Request Detailed Architectural Drawings: Available Upon Request
