Security

Accounts sign in with an email address and password or with Google sign-in. Passwords are handled by our managed authentication provider and are never stored by Lupley in a form we can read. Sessions are issued as signed tokens that expire and refresh, and signing out clears the session in the browser.

Every workspace has three roles: Owner, Admin and User. Invitations, role changes and member removal are restricted to the Owner and Admins, and the Owner cannot be removed or downgraded. Permission checks run on the server and in the database, not only in the interface, so a restricted action cannot be reached by editing a URL or calling an endpoint directly.

Database access rules scope every read and write to the workspace the signed-in account belongs to. Public feedback boards, roadmaps and newsletters are served through dedicated read paths that expose only the fields a visitor is meant to see, and private notes, internal statuses and subscriber lists are never included in those public responses.

Traffic to Lupley, including dashboard sessions and public board pages, is served over HTTPS. API traffic between the application and our managed database and email providers also travels over encrypted connections.

Workspace data, uploaded logos and newsletter content are stored with managed infrastructure providers that apply encryption at rest to the storage layer. Access to stored data from the application is limited to the paths the product needs.

Administrative credentials and service keys are kept as server side secrets, are never shipped to the browser, and are used only by server code for operations that require them. Administrative access is limited to the people who need it to operate and support the service.

Application and platform errors are logged so we can detect failures and unusual behaviour. We keep our platform, framework and dependencies up to date and review dependency advisories, applying security relevant updates as part of normal maintenance.

Lupley runs on managed database infrastructure that performs automated backups at the platform level. We do not publish specific retention windows or recovery objectives on this page, because we only state commitments we can stand behind. If you need backup or recovery details for a security review, contact security@getlupley.com.

If we become aware of a security incident affecting Lupley data, we investigate, work to contain and remediate it, and notify affected workspace Owners where notification is appropriate or legally required, along with the information we have and the steps we are taking.

• Use a strong, unique password, or sign in with Google.
• Give each teammate their own account instead of sharing one login.
• Grant the Admin role only to people who need to manage members.
• Remove members as soon as they no longer need access.
• Review what you publish on your public board so private details are not exposed.
• Report suspected account compromise immediately.

We welcome responsible disclosure. Email security@getlupley.com with a description of the issue, the steps to reproduce it and its potential impact. Please give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly, use only test accounts and test data, and do not access, modify or delete another customer's data, degrade the service, or run denial of service testing.

No online service can guarantee absolute security. This page describes practices that are in place today. We do not claim any certification, audit report, formal compliance attestation or insurance coverage. If a security questionnaire requires information we have not published here, contact security@getlupley.com rather than assuming it.