Security at Lotics

Lotics runs on Render (Singapore) with a managed PostgreSQL database, a managed cache, and encrypted disks. Files are stored in a private Cloudflare bucket and served only through an authenticated edge proxy: stored objects are never publicly reachable. Both providers hold independent SOC 2 Type II audits and publish their reports.

• In transit: all connections use TLS.
• At rest: databases, cache, and backups are encrypted at rest.
• Connected-account credentials: credentials for third-party accounts you connect are additionally encrypted at the application layer (AES-256-GCM) before storage, protecting them beyond disk-level encryption.

Customer data runs on managed infrastructure with automated, encrypted database backups. Point-in-time recovery covers the previous 3 days, a logical backup of each workspace is taken daily and kept for 30 days in object storage, and files are held in high-durability object storage.

When your contract ends, we hand over your data within 7 working days of your request and delete it within 30 working days after the handover, and never earlier than 60 days after termination, so there is always time to ask for a copy. You can also export your personal data and request erasure of your account at any time, through a confirmed, time-bound deletion process.

• Multi-factor authentication (TOTP, with backup codes) is available.
• Passwords are hashed with a memory-hard algorithm, and a minimum length is enforced.
• Role-based access control governs every workspace: members see only the data their role and record-visibility rules allow.
• Tenant isolation: each organization's and workspace's data is segregated, and access is re-checked on every request, across the API, streaming responses, and background jobs.
• Automatic deprovisioning: when a member leaves an organization, their roles, group memberships, and connected accounts are revoked automatically.
• Sessions and API keys are individually revocable, and a revocation takes effect across all servers immediately.

No Lotics tool or process reads your records. Building and operating what you asked us for does not read them. For as long as we operate your workspace we hold a seat in your organization and an API key, both listed in your settings — under Members and API keys — for you to end at any time. Outside our tooling there is one path, the hosting provider's database console: held by a single named administrator, used only to capture evidence during an incident, and recorded each time it is opened.

Security-relevant actions are recorded in an append-only audit log. Each entry carries a cryptographic tamper-evidence signature, so any later modification or forged entry is detectable.

Once a year, or after an incident, you may verify our compliance with these commitments: by questionnaire, by an independent report or certification, or on site where those do not answer the question.

The assistant, document extraction, and workflow steps that call a model send the prompt and any document they read to Anthropic through its API, under commercial terms that prohibit training on customer data and limit retention. No model runs on our infrastructure. The assistant acts within the permissions of the member using it: it cannot read a table that member cannot read, and it cannot change a record that member cannot change. Code the assistant writes runs in an isolated sandbox that can reach only Lotics storage, the Lotics API and, while it builds an app, the npm package registry. Image generation sends the text prompt, and nothing else, to OpenAI.

Our analytics and logs carry counts, identifiers and request metadata, never the content of a record, a document or a message. We do not record user sessions.

Uploaded files are screened at the boundary: executable and script content is rejected by file signature, not just by extension; the stored size is verified after upload; and files are served as downloads through an authenticated proxy so they cannot run in your browser.

• Authentication and API endpoints are rate-limited to throttle brute-force attempts and automated scraping.
• Every response carries hardened HTTP security headers, including HSTS, a Content-Security-Policy, and clickjacking and MIME-sniffing protections.

• Every change is peer-reviewed and must pass automated checks before it ships.
• Our continuous-integration pipeline blocks known-vulnerable dependencies, and we receive automated weekly security updates.
• Secrets are kept out of source code and validated at startup; access to them is restricted.

If a security incident affects your data, we notify you within 24 hours of confirming it: what happened, which data and how many people were affected, the likely consequences, what we are doing about it, and whom to contact. We send what we know at that point rather than waiting for the investigation to finish, so you can meet your own reporting deadlines.

• Lotics acts as a data processor on your behalf; you remain the controller of your data.
• Our obligations as a processor come from Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP. We follow GDPR-aligned practices for EU/EEA data.
• We process and store data outside Vietnam; see Subprocessors for the current hosting locations.
• We do not accept Protected Health Information (PHI); it is prohibited by our agreement.