Security

All traffic is TLS 1.2 or above, with HSTS enabled and preloaded so a browser will not fall back to plain HTTP.

Data at rest is encrypted by our database provider. Our own nightly export is compressed, not encrypted, and is held on an access-restricted host — see Backups and recovery, which says plainly where that falls short today.

Passwords are hashed with argon2id — memory-hard, and never reversible.

Access tokens live for 15 minutes and are held in memory only. The refresh token is an httpOnly, SameSite cookie that JavaScript cannot read, so a cross-site scripting bug cannot steal a long-lived credential.

Login is rate limited to 10 attempts per 15 minutes per address, with per-account lockout after 8 consecutive failures.

Every business record carries a workspace id, and every query is constructed through a single helper that injects it. There is no supported way to build a query without it.

A token issued for one workspace is rejected outright if presented against another, independently of the query layer.

We set Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and Referrer-Policy on every response.

Framing is denied entirely, which closes clickjacking against a point-of-sale screen.

Production error responses contain a stable error code, a safe message and a request id. No stack traces, no database errors, no route listings.

We publish no API schema or interactive docs on production. We adopted this rule after auditing a live competitor that shipped debug mode enabled and exposed all 541 of its endpoints publicly.

Every mutating action records who did it, when, from what address, and what changed.

Financial ledger rows are append-only. A correction is a new reversing entry, never an edit, so history cannot be quietly rewritten.

Production access is limited to named engineers over SSH key pairs, with password authentication disabled. We do not yet require a second factor on that login, and we are not going to describe a control we have not built.

Anyone with that access can read the database, because the connection string sits on the host. There is no support-side access grant or per-lookup consent record yet — an engineer reading your data would leave an operating-system trail, not an entry in your workspace audit log. Every action taken in the product is audited; this is about the layer underneath it.

Every collection is exported nightly to a single compressed file, kept for fourteen days on an access-restricted host, with a mode that denies every other account on it.

Three things this is not, so you can judge it accurately: the export is gzip, not encrypted; recovery is to the last nightly snapshot, so there is no point-in-time restore and up to a day of work is at risk; and while every run is logged, we do not yet rehearse restores on a schedule. Off-host copies and encryption at rest are the next thing we are building here.

If you find a vulnerability, email security@lacspace.com. We acknowledge within one working day.

We will not take legal action against good-faith research that avoids privacy violations, service degradation and data destruction. Please give us a reasonable window before publishing.