Security is foundational for a platform that handles R&D data. This page summarizes the controls we rely on today and the programs we are building toward.
Authentication and access
- Authentication is handled by Clerk, a SOC 2 Type II certified identity provider, with support for password + email magic-links, MFA, and organization-scoped access. Enterprise SSO runs through the same identity provider and is configured on request.
- Every protected API request is authenticated and scoped to an organization server-side. Organizations have owner, admin, billing admin, and member roles.
- Sessions are rotated regularly; API keys are per-organization and individually revocable from the dashboard.
Data protection
- All traffic is encrypted in transit via TLS 1.2+ (HTTPS-only; HSTS enabled on the web app).
- Customer data is stored in a managed PostgreSQL database (DigitalOcean) with provider-managed encryption at rest and automated backups under our hosting provider's managed backup policy (see our Data Processing Addendum).
- Large artifacts are stored in S3-compatible object storage (DigitalOcean Spaces), encrypted at rest by the provider.
- Secrets are held in environment variables managed by the hosting platform; never checked into source control.
Application security
- Input validation and response schema enforcement via Pydantic on the backend and strict TypeScript on the frontend.
- Dependencies are reviewed and updated regularly, with security advisories prioritized.
- Proxy-level rate limiting is enforced; burst traffic is back-pressured.
Operational security
- CI runs lints and tests on pull requests.
- Infrastructure is defined as code and changes go through version control.
- API requests are logged per organization, and organization admin actions are recorded in an audit trail.
Incident response
We follow a standard process for security incidents: detect, contain, eradicate, recover, and post-mortem. If an incident materially affects customer data, we will notify affected customers within 72 hours.
Responsible disclosure
We welcome good-faith security research. If you believe you have found a vulnerability, please email nick@latticegraph.com with details and reproduction steps. We commit to:
- Acknowledge your report within 3 business days.
- Provide a triage update within 7 business days.
- Credit you publicly (with your permission) once the issue is resolved.
Do not perform testing that degrades service for other users, accesses data that is not your own, or violates applicable law.
On our roadmap
- SOC 2 Type II attestation (planned).
- Customer-managed encryption keys (BYOK) for Enterprise.
- Third-party penetration testing.
- Regional data residency options (data is hosted in the US today).
Contact
Security questions or DD requests: nick@latticegraph.com