TermsPrivacySecuritySubprocessors

Security at Lotics

We build Lotics to protect your data on every path. This page summarizes the security practices and controls in place today. For the third parties that process data on our behalf, see our Subprocessors page.

Hosting & infrastructure

Lotics runs on Render (Singapore) with a managed PostgreSQL database, a managed cache, and encrypted disks. Files are stored in a private Cloudflare bucket and served only through an authenticated edge proxy — stored objects are never publicly reachable.

Encryption

  • In transit: all connections use TLS.
  • At rest: databases, cache, and backups are encrypted at rest.
  • Connected-account credentials: credentials for third-party accounts you connect are additionally encrypted at the application layer (AES-256-GCM) before storage, protecting them beyond disk-level encryption.

Authentication & access

  • Multi-factor authentication (TOTP, with backup codes) is available.
  • Passwords are hashed with a memory-hard algorithm, and a minimum length is enforced.
  • Role-based access control governs every workspace: members see only the data their role and record-visibility rules allow.
  • Tenant isolation: each organization's and workspace's data is segregated, and access is re-checked on every request — across the API, real-time channels, and background jobs.
  • Automatic deprovisioning: when a member leaves an organization, their roles, group memberships, and connected accounts are revoked automatically.
  • Sessions and API keys are individually revocable, and a revocation takes effect across all servers immediately.

Network & abuse protection

  • Authentication and API endpoints are rate-limited to throttle brute-force attempts and automated scraping.
  • Every response carries hardened HTTP security headers, including HSTS, a Content-Security-Policy, and clickjacking and MIME-sniffing protections.

File safety

Uploaded files are screened at the boundary: executable and script content is rejected by file signature — not just by extension — the stored size is verified after upload, and files are served as downloads through an authenticated proxy so they cannot run in your browser.

Resilience & backups

Customer data runs on managed infrastructure with automated, encrypted database backups and point-in-time recovery, and files are held in high-durability object storage.

Audit logging

Security-relevant actions are recorded in an append-only audit log. Each entry carries a cryptographic tamper-evidence signature, so any later modification or forged entry is detectable.

Application security

  • Every change is peer-reviewed and must pass automated checks before it ships.
  • Our continuous-integration pipeline blocks known-vulnerable dependencies, and we receive automated weekly security updates.
  • Secrets are kept out of source code and validated at startup; access to them is restricted.

Privacy & your data rights

  • Lotics acts as a data processor on your behalf; you remain the controller of your data.
  • You can export your personal data and request erasure of your account, which runs through a confirmed, time-bound deletion process.
  • We process and store data outside Vietnam — see Subprocessors for the current hosting locations — and follow GDPR-aligned practices.
  • We do not accept Protected Health Information (PHI) — it is prohibited by our agreement.

Compliance

Our security controls are designed and mapped to the SOC 2 Trust Services Criteria and ISO 27001, and we are preparing for certification. We follow GDPR-aligned practices as your data processor, with in-product data export and account erasure. We are not yet certified — this page reflects the controls in place today.

Reporting a security issue

If you discover a vulnerability or have a security question, contact us at support@lotics.ai.

Last updated: 26 July 2026.