Lath holds the thing that decides whether your customers can use your product. This page says how that is protected, and is deliberately specific — a security page made of adjectives is not one.
No SOC 2, no ISO 27001, no penetration test. None has been carried out. If a compliance review needs one, Lath is not ready for that review yet, and we would rather you learn it here than three weeks into a procurement process.
API keys and session tokens are stored as SHA-256 hashes with the plaintext held nowhere — a key is shown once at creation and cannot be recovered, only replaced. Sign-in is a single-use magic link that is destroyed when spent. Every denial returns one answer, so a caller cannot learn from a refusal whether an account exists.
Every read and every mutation is scoped to a workspace and a project derived from the credential itself, never from anything the caller sends. A request naming a project it does not hold is refused rather than filtered. This is enforced in the database layer and tested per operation, including tests that deliberately remove the scope clause and assert the boundary starts leaking — a check that has never failed is a check nobody has proved.
Customer records hold what a backend needs: an address, a plan, usage counters and the operations that changed them. No card numbers ever reach Lath — payment details are held by the payment processor and Lath stores an identifier. Mutations are append-only and attributed, so what changed and who changed it is answerable after the fact.
Lath runs on infrastructure it does not own, and the categories are published rather than the vendors: managed Postgres, object storage, edge compute, an email relay, and a payment processor. The specific list is available to customers on request under NDA. One leak is worth naming because it cannot be hidden: DKIM records on a sending domain reveal the mail provider to anyone who runs a DNS query.
Mail support@trylath.com with SECURITY in the subject. We will acknowledge within two business days and tell you what we intend to do. There is no bounty programme and no legal threat — report it and you will get a straight answer.