Security 
¶
Important
Please see our Trust Center for the SOC 2 report, security policies, controls & subprocessors.
We’re SOC2 certified and monitor compliance with HIPAA and ISO 27001.
See our status page for service health and availability.
Security at Lamin¶
Application security¶
AppSec is the practice of building software that is secure by design, secured during development, secured with testing and review, and deployed securely.
We build our software on distributed infrastructure in which client data is decoupled across databases, storage locations, data centers and networks. LaminHub’s data backends are deployed in a fully automated way in the distributed networks & data centers that host databases.
We have automated monitoring test applications that continuously check for networks & errors using observability providers: Sentry, AWS Inspector, Sprinto, Supabase & Cloudflare.
We use HTTPS for secure connections. We force HTTPS for all services using TLS (SSL), including our public website and the Dashboard to ensure secure connections.
All data in Lamin-managed deployments is encrypted in transit and at rest.
Internal code reviews are performed using a modern, PR-based development workflow on Github. Production deployments are gated on successful reviews and isolated test suites running in local environments for unit tests and staging environments for integration tests.
Corporate security¶
CorpSec is the practice of making sure Lamin employees have secure access to Lamin company infrastructure, and also that exposed channels to Lamin are secured. CorpSec controls are the primary concern of standards such as SOC2.
Access to our services and applications that connect to customer data is gated on a SSO Identity Provider (IdP) with the exception of GitHub, where our employees are allowed to maintain accounts linked to their IdP of choice.
We mandate phishing-resistant multi-factor authentication (MFA) in all enrolled services.
We regularly audit access to internal systems.
Bug bounty program¶
Keeping user data secure is a top priority at Lamin. We welcome contributions from the security community to identify vulnerabilities in our product and disclose them to us in a responsible manner. We offer rewards ranging from $100 to $1000+ depending on the severity of the issue discovered. To participate, please send a report of the vulnerability to security@lamin.ai.
Some Lamin resources are intentionally public. Reports that rely only on the following expected behavior are out of scope for bounty review:
public LaminDB instances allowing anonymous or unauthenticated read-only access
public instance metadata, public profile metadata, and public read-only database connection details for public instances
public S3 buckets or object listings that back public instances, public assets, examples, or documentation
public keys like anonymous API keys
client-side configuration files that expose publishable values, including Supabase anonymous API keys
enumeration of data that is already available through public Lamin pages, public APIs, public instances, public buckets, or public repositories
Data privacy¶
Lamin does not use your source code or data for its own purposes. Access for customer-requested support is limited to designated platform administrators. Lamin staff do not use customer data with consumer AI applications or unapproved browser extensions.
Frequently asked questions¶
Is SSO included, and can we use Microsoft Entra ID?¶
SSO is included in Team and Enterprise plans and configured during onboarding. Microsoft Entra ID (Azure) sign-in is also supported through OAuth, separately from organization SSO. Users do not need a separate Lamin password; password and MFA policies are managed by the identity provider.
Which logs can we review and export?¶
Database writes, permission changes, REST requests, MCP tool calls, and configured S3 activity are covered. Views beyond database writes are currently in Preview. See Audit log for coverage, access, and exports.
Can we control access for AI agents?¶
Bot accounts let you limit an agent’s access to specific databases and spaces. You control which AI tools your users and agents use. See Access permissions.
How are backups and recovery handled?¶
Lamin-managed AWS PostgreSQL deployments use automated backups. Retention and recovery arrangements depend on the deployment. For infrastructure you operate, your team manages backups and recovery. Our security policies cover business continuity and disaster recovery.
Do you provide an uptime SLA?¶
Uptime and support commitments are defined in your customer agreement. See our status page for service health and availability.
For security questionnaires or deployment reviews, contact security@lamin.ai.