How access is enforced, and what we will not promise.
LiftLine AI security posture: row-level access control, passkeys, what is deliberately not claimed, and how to report a vulnerability.
What we do, what we do not claim, and how to tell us about a problem. We would rather describe the design than make a promise nobody can keep.
How access is enforced
- Everything travels over encrypted connections.
- Access to your data is enforced by row-level security rules in the database itself, so a client asking for someone else's row is refused by the database rather than by our application code.
- Session tokens are stored in the iOS Keychain.
- We support passkeys, which cannot be phished the way passwords can.
- Payment card details never touch our systems.
- The administrative key that can bypass those rules exists only on our collection machine and in our server environment. It is never in the website, the app, or anything you download.
- The database is backed up on a short rolling schedule so an accident is recoverable.
What we do not claim
No system is perfectly secure and we are not going to tell you ours is. We are a very small operation. We hold no security certification, we have not had a third-party penetration test, and we will say so plainly rather than imply otherwise.
Reporting a vulnerability
Write to security@liftlineai.app. We will read it, we will act on it, and we will not pursue anyone who reports a problem responsibly and gives us a reasonable chance to fix it before disclosing it.
- Useful in a report
- What you did, what happened, and roughly when. A proof of concept helps but is not required.
- Please do not
- Access, modify, or delete data that is not yours; run automated scanning that degrades the service for other people; or test social engineering against anyone.
- Machine-readable
- https://liftlineai.app/.well-known/security.txt
If something goes wrong
If a breach affects your personal information we will notify you and the relevant authorities as the law requires, without unreasonable delay.
- PrivacyWhat there is to protect in the first place.