Lexova is a vertical operating system for Regulated Canadian Immigration Consultants and immigration lawyers. It ingests bilingual client intakes, resolves them into a normalized Person data model, and auto-populates 38 IRCC form-language combinations as byte-perfect PDFs — preserving Adobe's DocMDP certification ribbon. Every layer is built around regulated-market constraints: tenant isolation, role-based access, and Quebec Law 25 / PIPEDA data residency.
Lexova's split stack keeps domain logic in TypeScript and byte-level PDF work in Python — so 38 form-language combinations autofill without breaking Adobe's certification.
EN/FR client data is captured through an 8-step wizard and normalized into a shared Person model with role resolution (principal, spouse, child).
TypeScript form-specific mappers transform structured data into XFA XML, with FR path-rewriting rules that remap per-column table headers.
A Python FastAPI + PyMuPDF microservice performs an incremental write into the IRCC template, never rewriting the document body.
The DocMDP /P=2 certification ribbon stays intact — the cert is blue, the form is officially submittable to IRCC.
A split stack keeps data→XFA mapping in TypeScript while a Python FastAPI microservice performs byte-level incremental writes with PyMuPDF. The IRCC DocMDP /P=2 certification ribbon survives autofill — the cert stays blue, the form stays officially submittable.
EN/FR is enforced at every layer: form fields, compliance documents, dashboards, and Zod v4 error messages routed through a locale-aware schema factory. FR path-rewriting rules remap per-column table headers so French forms bind correctly.
SUPER_ADMIN, AGENCY_ADMIN, AGENT, CLIENT, and EMPLOYER each get a distinct dashboard. A dual-layer Prisma vault injects tenant predicates on every query; SUPER_ADMIN is structurally barred from case content. 39 adversarial cross-tenant assertions guard the boundary.
All personal data lives in Supabase PostgreSQL in ca-central-1. Lexova operates as a data processor; the firm is the controller. Consent versions and timestamps are tracked per user to satisfy Law 25, PIPEDA, and Alberta PIPA.
Personal data lives exclusively in Supabase PostgreSQL in ca-central-1. Lexova operates as a data processor while the firm remains the controller; consent versions and timestamps are tracked per user. A dual-layer Prisma vault injects tenant predicates on every query, and 39 adversarial cross-tenant assertions ensure that even a SUPER_ADMIN cannot read case content — satisfying Quebec Law 25, PIPEDA, and Alberta PIPA by construction.
A bilingual, multi-tenant SaaS that turns EN/FR client intakes into certified, XFA-aware IRCC PDFs — with five-role isolation and 100% Canadian data residency.