Lithiq OS
Security
How we protect your fabrication data — from encryption and authentication to infrastructure and access control.
Encryption at rest
- AES-256-GCM encryption for all sensitive data
- OAuth tokens, session tokens, and integration credentials encrypted automatically
- Random 12-byte IV per encryption with authentication tags
- Encryption key derived from ENCRYPTION_SECRET with scrypt
Authentication
- bcrypt password hashing with 12 rounds
- JWT sessions with 8-hour expiry
- HTTP-only, secure cookies with SameSite=Lax
- Brute-force protection: 10 attempts per 15 minutes per IP
- All login attempts logged with IP and user agent
Authorization (RBAC)
- Role-based access: Company Admin, Sales, Estimator
- 8 granular permissions per role
- Lithiq staff roles for cross-tenant support
- Every resource access checked against tenant ownership
- Staff access is logged and auditable
Audit logging
- Every significant action logged to the database
- Login attempts, data changes, API calls tracked
- IP address and user agent captured
- Failed login reasons recorded
- Audit logs are append-only and cannot be modified
Infrastructure
- Hosted on Vercel with edge runtime
- Neon PostgreSQL with point-in-time recovery
- Cloudflare R2 for object storage (tenant-isolated)
- Upstash Redis for rate limiting and caching
- Automatic database backups
Transport security
- HSTS with 2-year max-age and preload
- Content Security Policy on all pages
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
Data isolation
- Each company's data fully isolated at the database level
- All API routes verify tenant ownership before returning data
- File uploads scoped to company directories
- Cross-tenant access blocked and logged
- Staff access bypass is auditable
Questions about security?
Contact our team for a detailed security overview or to discuss compliance requirements.
Contact us