Security and trust
What we store, where it lives, who can see it and how we protect it, in plain words for your security review.
Is Lighthouse secure?
Lighthouse stores workspace data in the United States, encrypted in transit and at rest, with row-level security in the database, and never uses customer data to train AI models. SSO is not available yet, and a SOC 2 audit is in preparation, not complete.
Access control
One workspace cannot read another’s projects, and project sharing, view or edit, is enforced in the database as well as in the app.
Encryption
TLS in transit and encryption at rest by our database provider. API keys are stored as hashes, not in plain text.
Authentication
Magic links or passwords. SSO is not available yet.
Your data
Export your data from the app or the API. For deletion or other privacy requests, write to us and we will confirm when it is done.
Compliance
We are preparing for a SOC 2 audit; there is no SOC 2 report yet. Our subprocessor list, security questionnaire answers and data processing agreement are available on request.
Questions people ask
Does Lighthouse train AI models on my data?
No. Lighthouse does not train AI models, and your workspace data is not used to train any.
Where is my data stored?
In the United States, in a managed Postgres database (Supabase) with row-level security, encrypted in transit and at rest.
Is Lighthouse SOC 2 compliant?
Not yet. We are preparing for a SOC 2 audit and do not have a SOC 2 report today. Ask us for our security questionnaire answers in the meantime.
How do I report a vulnerability?
Email [email protected] with the subject line "Security disclosure".