Security at Lotics

We build Lotics to protect your data on every path. This page states the security practices and controls in place today, and the commitments our service contract makes about them. For the third parties that process data on our behalf, see Subprocessors.

Hosting & infrastructure

Lotics runs on Render (Singapore) with a managed PostgreSQL database, a managed cache, and encrypted disks. Files are stored in a private Cloudflare bucket and served only through an authenticated edge proxy: stored objects are never publicly reachable. Both providers hold independent SOC 2 Type II audits and publish their reports.

Encryption

  • In transit: all connections use TLS.
  • At rest: databases, cache, and backups are encrypted at rest.
  • Connected-account credentials: credentials for third-party accounts you connect are additionally encrypted at the application layer (AES-256-GCM) before storage, protecting them beyond disk-level encryption.

Authentication & access

  • Multi-factor authentication (TOTP, with backup codes) is available.
  • Passwords are hashed with a memory-hard algorithm, and a minimum length is enforced.
  • Role-based access control governs every workspace: members see only the data their role and record-visibility rules allow.
  • Tenant isolation: each organization's and workspace's data is segregated, and access is re-checked on every request, across the API, streaming responses, and background jobs.
  • Automatic deprovisioning: when a member leaves an organization, their roles, group memberships, and connected accounts are revoked automatically.
  • Sessions and API keys are individually revocable, and a revocation takes effect across all servers immediately.

Our access to your data

No Lotics tool or process reads your records. Building and operating what you asked us for does not read them. For as long as we operate your workspace we hold a seat in your organization and an API key, both listed in your settings — under Members and API keys — for you to end at any time. Outside our tooling there is one path, the hosting provider's database console: held by a single named administrator, used only to capture evidence during an incident, and recorded each time it is opened.

AI features

The assistant, document extraction, and workflow steps that call a model send the prompt and any document they read to Anthropic through its API, under commercial terms that prohibit training on customer data and limit retention. No model runs on our infrastructure. The assistant acts within the permissions of the member using it: it cannot read a table that member cannot read, and it cannot change a record that member cannot change. Code the assistant writes runs in an isolated sandbox that can reach only Lotics storage, the Lotics API and, while it builds an app, the npm package registry. Image generation sends the text prompt, and nothing else, to OpenAI.

Telemetry

Our analytics and logs carry counts, identifiers and request metadata, never the content of a record, a document or a message. We do not record user sessions.

Network & abuse protection

  • Authentication and API endpoints are rate-limited to throttle brute-force attempts and automated scraping.
  • Every response carries hardened HTTP security headers, including HSTS, a Content-Security-Policy, and clickjacking and MIME-sniffing protections.

File safety

Uploaded files are screened at the boundary: executable and script content is rejected by file signature, not just by extension; the stored size is verified after upload; and files are served as downloads through an authenticated proxy so they cannot run in your browser.

Resilience & backups

Customer data runs on managed infrastructure with automated, encrypted database backups. Point-in-time recovery covers the previous 3 days, a logical backup of each workspace is taken daily and kept for 30 days in object storage, and files are held in high-durability object storage.

Incident response

If a security incident affects your data, we notify you within 24 hours of confirming it: what happened, which data and how many people were affected, the likely consequences, what we are doing about it, and whom to contact. We send what we know at that point rather than waiting for the investigation to finish, so you can meet your own reporting deadlines.

Data return and deletion

When your contract ends, we hand over your data within 7 working days of your request and delete it within 30 working days after the handover, and never earlier than 60 days after termination, so there is always time to ask for a copy. You can also export your personal data and request erasure of your account at any time, through a confirmed, time-bound deletion process.

Audit logging

Security-relevant actions are recorded in an append-only audit log. Each entry carries a cryptographic tamper-evidence signature, so any later modification or forged entry is detectable.

Application security

  • Every change is peer-reviewed and must pass automated checks before it ships.
  • Our continuous-integration pipeline blocks known-vulnerable dependencies, and we receive automated weekly security updates.
  • Secrets are kept out of source code and validated at startup; access to them is restricted.

Your right to audit

Once a year, or after an incident, you may verify our compliance with these commitments: by questionnaire, by an independent report or certification, or on site where those do not answer the question.

Privacy & compliance

  • Lotics acts as a data processor on your behalf; you remain the controller of your data.
  • Our obligations as a processor come from Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP. We follow GDPR-aligned practices for EU/EEA data.
  • Our controls are designed and mapped to the SOC 2 Trust Services Criteria and ISO 27001, and we are preparing for certification. We are not yet certified: this page reflects the controls in place today.
  • We process and store data outside Vietnam; see Subprocessors for the current hosting locations.
  • We do not accept Protected Health Information (PHI); it is prohibited by our agreement.

Reporting a security issue

If you discover a vulnerability or have a security question, contact us at [email protected]. The same contact is published in our security.txt.

Last updated: 5 September 2026.