How your Lex wallet is secured
Lex is a self-custodial money and investing app: only your passkey can approve a transaction from your wallet, and Lex has no signing access.
How the passkey wallet works
Turnkey provides the infrastructure that secures Lex wallet keys and processes authorized signatures. Lex creates a separate Turnkey sub-organization for each user, with that user as the controlling account and their passkey as the initial authenticator. Lex prepares the transaction for review, then relays the authorization produced by your device. Lex cannot use its own administrative credentials to sign a transaction from your wallet. Turnkey performs key generation and signing in secure enclaves: computing environments isolated by hardware, with checks on the software running inside. Your passkey authorizes access; it is not the blockchain private key itself.
Recovery, and its limit
If you lose your phone, verify your email and phone number, then create a new passkey. If you lose your passkey and every recovery method, Lex cannot recover your assets. Keep your passkey and recovery methods secure.
Take your assets anywhere
You can send your assets to another wallet. The app also has a protected private-key export. It is a separate feature; do not assume every account or app version offers it. A private key gives transaction authority to whoever obtains it, so never share it with someone claiming to provide support.
What Lex can and cannot do
Lex gives you a clear view of your assets and asks for your approval before they move. Lex cannot move your funds without your authorization, and it cannot sign for you. Lex cannot reverse blockchain transactions, and it cannot restore access if you lose your passkey and every recovery method. Lex does not custody assets or act as principal or counterparty.
Who provides each service
Parts of the service are provided by third parties under their own terms. For a bank route, the provider identified in the app handles verification, conversion and settlement. The tokenized assets in Lex are issued by third parties, not by Lex. Each asset’s page shows its issuer, network, and documents.
Turnkey
Turnkey provides the wallet key infrastructure.
Bridge
Bridge provides bank transfers in US dollars (ACH or wire), euros (SEPA), and British pounds (Faster Payments), after identity verification.
Circle
Circle issues USDC, a dollar stablecoin, and EURC, a euro stablecoin.
Ripio
Ripio issues wMXN, wBRL, wARS, and wCOP. These tokens track their respective currencies; they are not USDC or dollar balances.
Etherfuse
Etherfuse issues the government bond tokens, such as CETES and TESOURO.
Anthropic
Ask Lex is built on an AI model from Anthropic. To answer you, Lex sends Anthropic your question, the relevant part of the conversation, and the account facts that question needs. Your wallet address, identity details, sign-in credentials and the people you send money to are left out.
What Lex is not
Lex is a financial technology company, not a bank, broker, or investment adviser. Your assets are not bank deposits and are not covered by deposit insurance such as the FDIC, IPAB, or FGC. Self-custody is not deposit insurance or a guarantee about every legal or insolvency outcome. The Lex website and mobile application are operated by Gingham Holdings, Inc. d/b/a Lex.
Your data
Lex does not have, and never collects, your private keys. Lex protects your information with measures that include encryption in transit and at rest, and saved bank details are encrypted with managed keys. In the mobile app, analytics, IP-derived location and device diagnostics start only after you confirm them. The apps also report installs and app opens to our advertising measurement provider from first launch, which you can turn off under Account → Privacy & Data. When you delete your account, cleanup is scheduled within 30 days, subject to settlement of pending financial activity and records that must be retained. Wallet addresses and transaction history are visible on public blockchains, and Lex cannot erase those records. This website works differently from the app: it uses cookies, pixels and similar technologies, and currently starts analytics and advertising tracking without an on-site consent or opt-out control. No method of transmission or storage is completely secure; protect your device and your passkey.
Report a security issue
To report a security issue, email support@getlex.com with "SECURITY" in the subject line. Lex will never ask for your passkey, private key, or one-time codes.