SECURITY AND PRIVACY
Security and privacy, stated precisely.
Every control below is marked in place, in progress or not yet. Nothing here is a badge we do not hold.
CONTROLS
Where each control stands. In place, in progress, or not yet.
| Control | State | Evidence or note |
|---|---|---|
| Device IDs scoped per customer account | In place | The same laptop has a different ID at every customer. |
| Verdicts fetched server-side with your API key | In place | Server API docs |
| Encryption in transit (TLS 1.2 and 1.3) | In place | |
| API keys stored only as hashes, shown once | In place | You see a key once, when you create it. We cannot show it again. |
| Tenant isolation enforced on every query | In place | Enforced in the application. Database row-level security is in staged rollout. |
| Right to erasure | In progress | Requests go to privacy@lightningresearch.ai. |
| SOC 2 | Not yet | |
| Third-party penetration test | Not yet | |
| Public status page | In place | Status |
Device IDs scoped per customer account
In place
The same laptop has a different ID at every customer.
Verdicts fetched server-side with your API key
In place
Encryption in transit (TLS 1.2 and 1.3)
In place
API keys stored only as hashes, shown once
In place
You see a key once, when you create it. We cannot show it again.
Tenant isolation enforced on every query
In place
Enforced in the application. Database row-level security is in staged rollout.
Right to erasure
In progress
Requests go to privacy@lightningresearch.ai.
SOC 2
Not yet
Third-party penetration test
Not yet
Public status page
In place
COLLECTION
What we collect, and what we do not.
Some laws treat IP addresses and device signals as personal data. We treat them that way too.
We collect
- Browser, hardware and runtime signals, such as GPU, canvas, audio, fonts, screen and time zone
- The IP address and user-agent string of each request
- What your server sends with it
- The IP address the browser's own WebRTC connection reveals, which can differ from the request's behind a proxy
- Once per session, a signed reading of the browser's connection to our edge check on Cloudflare, which includes the IP address, its network and location, the data center and round-trip times
The SDK does not collect
- Names
- Email addresses
- Phone numbers
- Postal addresses
- Payment data
- Government IDs
- How long we keep it
- Retention is set per contract on Enterprise. Ask us for the current schedule on other plans.
- Where it goes
- Device IDs are scoped to your account and mean nothing anywhere else. We do not sell data.
DATA FLOW
How data moves. What travels on each path, and where it ends up.
- Your server → LR Defender: a session token request, with your API key
- Browser SDK → LR Defender: device signals, the IP address, the user-agent string and the edge check's reading
- LR Defender → Browser: a requestId, with the risk level and its reasons
- Your server → LR Defender: the verdict for that requestId, fetched with your API key
- LR Defender → Dashboard: every event, for the people on your account
- LR Defender → Your endpoint: the events you subscribe to, as webhooks
Identifications and events are stored in LR Defender's database on Amazon Web Services, scoped to your account. The verdict you act on comes from our server, fetched with your API key, not from the browser. The drawing leaves out one path: once per session, the SDK opens a connection to our edge check, a Worker on Cloudflare, which times it and returns a signed reading that the SDK sends to us with the identify call.
SUBPROCESSORS
Who processes data for us.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting and infrastructure | |
| Cloudflare | Runs our edge check, a timing check of the browser's connection used to detect proxies. It processes the visitor's IP address, the network and location Cloudflare associates with that address, the data center that took the connection, round-trip times and a short-lived ticket from our API. |
Full list on request from privacy@lightningresearch.ai.
RESPONSIBLE DISCLOSURE
Report a vulnerability.
Report a vulnerability to security@lightningresearch.ai. We acknowledge reports and keep you updated until they are fixed. Please do not access other customers' data or degrade the service while testing.
Machine-readable contact details: security.txt
DPA AND PRIVACY REQUESTS
Ask for our DPA.
Ask for our data processing agreement or make a privacy request at privacy@lightningresearch.ai.
Read the privacy policyQuestions
On Amazon Web Services in the United States.
No.
Yes. Send the device ID to privacy@lightningresearch.ai. Erasure stays marked in progress above until we have verified it end to end in production.
Ask us and we will answer yours.
SECURITY REVIEW
Need a security review?
Send us your questionnaire or your questions. An engineer who builds LR Defender answers them.
Prefer to talk it through?
Tell us what your review needs, and an engineer replies by email.