Security and responsible disclosure
The service’s security boundaries, customer responsibilities and reporting contact.
Effective 25 October 2026, version 2026-10-25
Control-plane safeguards
Workspace membership and owner roles are checked server-side. Project keys are stored as hashes. SDK requests bind method, path, timestamp and body through signatures with replay checks. One-use handoffs and scoped visitor access are verified against current expiry, revocation and resource generation. Lifecycle commands are bounded, leased and acknowledged before cleanup is considered complete.
Optional telemetry uses allowlisted fields rather than raw request data or error messages. Do not submit secrets or personal customer records in project configuration or support text. Production operations require TLS, restricted provider access, credential rotation, backups and monitoring of worker/agent health.
What the customer must secure
Use a dedicated demo database and deployment. Your application must enforce authorization and row isolation on every read and write, deny external side effects, validate recipe limits and keep its agent running through resource cleanup. The reference adapter uses PostgreSQL row-level policies; another adapter needs its own equivalent controls.
The platform cannot certify arbitrary application code, stop every outbound effect in an improperly configured deployment, or erase customer resources while its agent is offline. It is not a VM/container isolation guarantee. We do not claim ISO/SOC certification, penetration-test completion, guaranteed uptime or a bug-bounty program.
Report a vulnerability
Email security@trylane.app with a concise description, affected route/component, impact and safe reproduction steps. Avoid sending access tokens, production records or exploit payloads containing other users’ information. Test only accounts/environments you control; stop if you encounter another person’s data and tell us privately.
We review reports and coordinate remediation and disclosure in good faith. No reward or fixed response-time commitment is promised. Security incidents affecting personal data are assessed and notified to customers, affected people and regulators as required by applicable law.
Questions about this document? contact@trylane.app