Trust Center
How We Protect Your Data
We build security, observability, and compliance software, so we hold ourselves to the same standard. Everything a security review usually asks for starts here.
Policies and documents
Security Practices
Your data stays where you put it
- Every product can run in your own cloud account, data center, or an air-gapped network.
- Managed cloud runs in UAE, EU (Frankfurt), or US regions; you choose the region.
- No cross-tenant data pooling: each tenant has separate data partitions and encryption keys.
- We never use customer telemetry, findings, documents, or code to train AI models.
Access is scoped and recorded
- Single sign-on through SAML 2.0 or OIDC, with role-based access across all products.
- AI agents receive short-lived tokens limited to the tools their task needs.
- Changes proposed by agents require approval from a person.
- Actions are attributed to a person or an agent and kept in an audit trail.
This website
- Served only over HTTPS, with HSTS enabled.
- A strict Content Security Policy: scripts load only from lionhouse.dev, and the site cannot be framed.
- No cookies, analytics, or third-party trackers.
- A published security.txt and a vulnerability disclosure policy with a safe harbor for good-faith research.
Compliance & Documents
Documents for Your Security Review
Security questionnaires, architecture and data-flow documentation, and the current status of our compliance programs are available to prospective customers on request, under NDA where needed.
Request documentsSubprocessors
Who Processes Website Data
| Provider | Purpose |
|---|---|
| Website hosting provider | Serving lionhouse.dev and rate-limiting form submissions |
| Slack | Delivering contact form requests to our team |
Self-hosted deployments add no Lionhouse subprocessors. Subprocessors for managed cloud are listed in your agreement and available on request.
Found a security issue?
Email security@lionhouse.dev. We acknowledge reports within 3 business days.