Security

• In transit. TLS 1.2+ on every connection. HSTS preloaded.
• At rest. AES-256 disk encryption on database and object storage.
• Row-level security. Every public-schema table enforces RLS so the database itself rejects unauthorised access — not just the application.
• Passwords. Bcrypt with per-user salt. We never see your password.
• End-to-end encryption. Optional client-side encryption for journal entries is on the roadmap; the toggle already lives in Settings → Privacy.

Only a small number of engineers have production access, granted via SSO with hardware-key 2FA, scoped to least privilege, and logged. We do not read your content; access to user data requires a documented incident, legal request, or your explicit support request.

Daily encrypted backups with point-in-time recovery for the last 7 days. Quarterly restore drills. RTO 4 hours, RPO 15 minutes.

We appreciate help finding bugs. If you discover a vulnerability:

1. Email security@lifeos.app with a reproducer.
2. Give us a reasonable window (we aim to acknowledge within 24 hours) before public disclosure.
3. Don't access data that isn't yours, don't run destructive tests, don't extort.

We don't currently have a paid bug-bounty programme but we're happy to credit you on this page (with your permission).

Live status: status.lifeos.app. Material incidents affecting your data are reported within 72 hours per GDPR, sooner where required.