Cyber Protection

This statement summarises the technical and organisational measures Lodfy uses to protect the Service and the data entrusted to us by our customers. It complements our Data Privacy Notice and our Privacy Policy.

1. Security governance

• Policies: we maintain a written information security policy framework covering acceptable use, access control, change management, incident response, secure development, vendor risk, and business continuity. Policies are reviewed at least annually.
• Roles: security ownership is assigned at leadership level. All personnel are accountable for following security policies; specific responsibilities are documented for engineering, operations, and support.
• Risk management: we conduct periodic risk assessments and track remediation through to closure.

2. Encryption

• In transit: all traffic between users and the Service is encrypted with modern TLS (HTTPS only). Old protocols and weak ciphers are disabled. HSTS is enforced on production domains.
• At rest: production databases, object storage, and backups are encrypted at rest using industry-standard algorithms managed by our infrastructure providers.
• Sensitive fields: particularly sensitive fields (for example credentials and tokens) receive additional application-level protection.

3. Access control

• Least privilege: access to production systems is restricted to the smallest number of staff needed and is reviewed regularly.
• Strong authentication: multi-factor authentication is required for administrative access. Customer sign-in supports email and password with rate limiting and account-lockout protections, with stronger options on the roadmap.
• Tenant isolation: customer data is logically isolated. Database row-level security policies enforce that users only see and modify their own organisation's data.
• Service accounts & secrets: service credentials are stored in a managed secrets store, rotated regularly, and never committed to source control.

4. Network and infrastructure

• Hosting: the platform runs on managed cloud infrastructure provided by Supabase and underlying Tier-1 cloud providers, in regions selected for performance and compliance.
• Segmentation: production environments are separated from development and test environments. Direct production database access is restricted to break-glass scenarios.
• Edge protection: we rely on provider-level distributed denial-of-service mitigation, web application firewalling, and rate limiting on public endpoints.
• Logging and monitoring: security-relevant events (authentication, administrative actions, configuration changes) are logged and retained for investigation.

5. Application security

• Secure development lifecycle: changes are developed in branches, peer-reviewed, and tested before release. Code is version-controlled and linked to defined tickets.
• Static and dependency analysis: we run automated checks for known vulnerable dependencies and common insecure patterns, and triage findings on a defined cadence.
• Input validation and output encoding: we validate user input, parameterise database queries, and encode output to mitigate injection and cross-site-scripting risks.
• Hardened browser policy: we apply a strict content-security policy and modern browser security headers.

6. Vulnerability management

• Patching: dependencies and base images are updated regularly; critical vulnerabilities are prioritised on an expedited timeline.
• Penetration testing: we engage qualified third parties to perform periodic application and infrastructure penetration tests; high and critical findings are remediated promptly.
• Responsible disclosure: we welcome good-faith vulnerability reports from researchers — see "Reporting a vulnerability" below.

7. Incident response

• Runbooks: we maintain documented incident response runbooks covering detection, triage, containment, eradication, recovery, and post-incident review.
• Notification: in the event of a personal-data breach affecting customer data, we notify affected customers without undue delay and provide the information they need to meet their own notification obligations. See our Data Privacy Notice for details.
• Post-incident review: every significant incident is followed by a blameless review and tracked corrective actions.

8. Business continuity and disaster recovery

• Backups: production databases are backed up on a regular schedule using our infrastructure provider's managed backup tooling, with backups encrypted and access-controlled.
• Recovery objectives: we aim for recovery time and recovery point objectives appropriate to a B2B SaaS platform. Restore procedures are tested periodically.
• Resilience: the application is designed to tolerate single-component failures, and critical infrastructure is provided by services with multi-zone redundancy.

9. Personnel security

• Background and reference checks: performed on personnel with access to production systems where permitted by local law.
• Confidentiality: all personnel are bound by written confidentiality obligations.
• Training: staff receive security and data-protection awareness training on hire and at regular intervals thereafter.
• Endpoint security: company devices are configured with full-disk encryption, automatic updates, and screen-lock policies.

10. Third-party and vendor risk management

Vendors and sub-processors with access to customer data are subject to security and data-protection assessments before being engaged, and reassessed as part of our ongoing due diligence. A current list of sub-processors is available in our Data Privacy Notice.

11. Customer responsibilities

Security is a shared responsibility. Customers should keep credentials confidential, enforce strong password and access policies within their organisation, promptly remove access when users leave, and configure user roles in line with the principle of least privilege. Customers must use the platform in accordance with our Terms of Service and all applicable laws.

12. Reporting a vulnerability

If you believe you have discovered a vulnerability in the Service, please report it via our contact form with as much detail as possible (steps to reproduce, affected URLs, impact). Please do not access data that does not belong to you, degrade the Service for others, or publicly disclose findings before we have had a reasonable opportunity to investigate and respond. We commit to acknowledging good-faith reports and keeping you informed during remediation.

13. Updates

We continually evolve our security practices. The "last updated" date at the top reflects the most recent material change to this statement.