Data ownership
Traces, prompts, policies, and evaluation cases belong to your organisation. We process them only to deliver the service and never use them to train models available to other customers.
Security & trust
Built for teams that answer to auditors.
Customer content is yours. Every change is attributable. Every access is logged.
Encryption
TLS 1.2+ in transit and AES-256 at rest. Customer-managed keys are available on Enterprise deployments.
Isolation
Each workspace is logically isolated with tenant-scoped keys. Harness execution runs in ephemeral, network-restricted sandboxes.
Access control
SSO via SAML or OIDC, SCIM provisioning, role-based permissions, and artifact-level ownership rules that mirror your CODEOWNERS.
Auditability
Every read, proposal, approval, and deployment is logged with actor, time, and evidence links. Logs export to your SIEM.
Residency
LonsLabs Cloud is hosted in the EU. Private-cloud and on-premises options keep content entirely within your environment.
Program
Practices, not promises.
Security at LonsLabs is a product property, not a page. The same traceability we sell — evidence, owner, review history — applies to our own infrastructure changes.
- Independent penetration testing at least annually.
- Vulnerability disclosure program with a public policy and safe-harbour terms.
- Least-privilege access with hardware-key MFA for all staff.
- Sub-processor list published and change-notified.
- Incident response with customer notification within 72 hours, as required by GDPR.
GDPRController and processor obligations met · DPA available
SOC 2 Type IIAudit in progress · report on request under NDA
ISO 27001Aligned controls · certification roadmap
EU AI ActChange records support Article 12 logging obligations
Sub-processorsEU cloud hosting, email delivery, error monitoring
Disclosure
Found something?
We take reports seriously and respond quickly.
Report a vulnerability
Email security@lonslabs.com with steps to reproduce. We acknowledge within two business days and keep you informed until resolution. Good-faith research under our policy will not face legal action.
Request documentation
DPA, sub-processor list, penetration-test summaries, and security questionnaires are available to customers and qualified prospects. Ask through the contact page.
Questions
Talk to our security team.
We are happy to walk through architecture, data flows, and controls in detail.
Contact us