#### Security

Important:

  Please see our Trust Center for the SOC 2 report, security policies,
  controls & subprocessors.We're SOC2 certified and monitor compliance
  with HIPAA and ISO 27001.See our status page for service health and
  availability.

### Security at Lamin

##### Application security

AppSec is the practice of building software that is secure by design,
secured during development, secured with testing and review, and
deployed securely.

We build our software on distributed infrastructure in which client
data is decoupled across databases, storage locations, data centers
and networks. LaminHub's data backends are deployed in a fully
automated way in the distributed networks & data centers that host
databases.

We have automated monitoring test applications that continuously check
for networks & errors using observability providers: Sentry, AWS
Inspector, Sprinto, Supabase & Cloudflare.

We use HTTPS for secure connections. We force HTTPS for all services
using TLS (SSL), including our public website and the Dashboard to
ensure secure connections.

All data in Lamin-managed deployments is encrypted in transit and at
rest.

Internal code reviews are performed using a modern, PR-based
development workflow on Github. Production deployments are gated on
successful reviews and isolated test suites running in local
environments for unit tests and staging environments for integration
tests.

##### Corporate security

CorpSec is the practice of making sure Lamin employees have secure
access to Lamin company infrastructure, and also that exposed channels
to Lamin are secured. CorpSec controls are the primary concern of
standards such as SOC2.

Access to our services and applications that connect to customer data
is gated on a SSO Identity Provider (IdP) with the exception of
GitHub, where our employees are allowed to maintain accounts linked to
their IdP of choice.

We mandate phishing-resistant multi-factor authentication (MFA) in all
enrolled services.

We regularly audit access to internal systems.

##### Bug bounty program

Keeping user data secure is a top priority at Lamin. We welcome
contributions from the security community to identify vulnerabilities
in our product and disclose them to us in a responsible manner. We
offer rewards ranging from $100 to $1000+ depending on the severity of
the issue discovered. To participate, please send a report of the
vulnerability to security@lamin.ai.

Some Lamin resources are intentionally public. Reports that rely only
on the following expected behavior are out of scope for bounty review:

* public LaminDB instances allowing anonymous or unauthenticated read-
  only access

* public instance metadata, public profile metadata, and public read-
  only database connection details for public instances

* public S3 buckets or object listings that back public instances,
  public assets, examples, or documentation

* public keys like anonymous API keys

* client-side configuration files that expose publishable values,
  including Supabase anonymous API keys

* enumeration of data that is already available through public Lamin
  pages, public APIs, public instances, public buckets, or public
  repositories

##### Data privacy

Lamin does not use your source code or data for its own purposes.
Access for customer-requested support is limited to designated
platform administrators. Lamin staff do not use customer data with
consumer AI applications or unapproved browser extensions.

### Frequently asked questions

##### Is SSO included, and can we use Microsoft Entra ID?

SSO is included in Team and Enterprise plans and configured during
onboarding. Microsoft Entra ID (Azure) sign-in is also supported
through OAuth, separately from organization SSO. Users do not need a
separate Lamin password; password and MFA policies are managed by the
identity provider.

##### Which logs can we review and export?

Database writes, permission changes, REST requests, MCP tool calls,
and configured S3 activity are covered. Views beyond database writes
are currently in **Preview**. See Audit log for coverage, access, and
exports.

##### Can we control access for AI agents?

Bot accounts let you limit an agent's access to specific databases and
spaces. You control which AI tools your users and agents use. See
Access permissions.

##### How are backups and recovery handled?

Lamin-managed AWS PostgreSQL deployments use automated backups.
Retention and recovery arrangements depend on the deployment. For
infrastructure you operate, your team manages backups and recovery.
Our security policies cover business continuity and disaster recovery.

##### Do you provide an uptime SLA?

Uptime and support commitments are defined in your customer agreement.
See our status page for service health and availability.

For security questionnaires or deployment reviews, contact
security@lamin.ai.