Security

All traffic is TLS 1.2 or above, with HSTS enabled and preloaded so a browser will not fall back to plain HTTP.

Data at rest is encrypted by our database and storage providers. Backups are encrypted with separately managed keys.

Passwords are hashed with argon2id — memory-hard, and never reversible.

Access tokens live for 15 minutes and are held in memory only. The refresh token is an httpOnly, SameSite cookie that JavaScript cannot read, so a cross-site scripting bug cannot steal a long-lived credential.

Login is rate limited to 10 attempts per 15 minutes per address, with per-account lockout after 8 consecutive failures.

Every business record carries a workspace id, and every query is constructed through a single helper that injects it. There is no supported way to build a query without it.

A token issued for one workspace is rejected outright if presented against another, independently of the query layer.

We set Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and Referrer-Policy on every response.

Framing is denied entirely, which closes clickjacking against a point-of-sale screen.

Production error responses contain a stable error code, a safe message and a request id. No stack traces, no database errors, no route listings.

We publish no API schema or interactive docs on production. We adopted this rule after auditing a live competitor that shipped debug mode enabled and exposed all 541 of its endpoints publicly.

Every mutating action records who did it, when, from what address, and what changed.

Financial ledger rows are append-only. A correction is a new reversing entry, never an edit, so history cannot be quietly rewritten.

Access to production is limited to named engineers, requires multi-factor authentication, and is logged.

Support staff cannot read your data without an access grant that is recorded in your workspace audit log.

Automated daily backups with point-in-time recovery. Restores are tested on a schedule rather than assumed to work.

Backups are retained for 30 days and encrypted at rest.

If you find a vulnerability, email security@lacspace.com. We acknowledge within one working day.

We will not take legal action against good-faith research that avoids privacy violations, service degradation and data destruction. Please give us a reasonable window before publishing.