Security at Lathe Studio
We built Lathe Studio with security as a core feature, not an afterthought. Here's how we protect your data.
Data Protection
All data is encrypted at rest using AES-256 and in transit via TLS 1.3. Test case data, execution results, and integration credentials never leave secure infrastructure.
Access Controls
Every request is authorized in the application layer against your organization and project memberships, with Row Level Security (RLS) policies in PostgreSQL as a second layer — the service can never serve another tenant's data. Role-based permissions step write access up from read-only viewers to admins.
Authentication
We use Clerk for authentication, which maintains SOC 2 Type II compliance. Multi-factor authentication is required for every account. Session management with automatic timeout.
Infrastructure
Our infrastructure is built on enterprise-grade platforms with redundancy, monitoring, and automated failover.
Security Highlights
- AES-256 encryption at rest
- TLS 1.3 for all data in transit
- Row Level Security (RLS) plus application-layer authorization
- Authentication by Clerk (SOC 2 Type II certified)
- Daily automated backups
Integrations
Jira, Slack, Teams, and CI/CD credentials are encrypted using AES-256-GCM with keys stored separately from application data. We never store integration passwords in plaintext.
Compliance
- GDPR and CCPA compliant
- Data processing agreements available on request
- Security program built to ISO 27001 standards, awaiting certification
Report a Vulnerability
Found a vulnerability? Contact us immediately. We aim to acknowledge reports within a few business days and maintain a disclosure policy for responsible security research.
security@lathe.studio