Encryption design, audit architecture, access controls, and compliance posture — all documented up front so your team can evaluate Lockzero without NDAs or long review cycles.
Everything here is what your auditor will ask for.
For evidence requests, SOC 2 reports, or DPA execution, email security@lockzero.io.
Every grade below is from a third-party scanner with public, re-runnable URLs. Click any card to verify our score yourself — right now.
Last verified 2026-05-18. Grades may evolve as we strengthen our infrastructure.
Most vendors say “trust us, we’re secure.” We show you the attack happening, and the moment it dies. Real tools, real terminals, real targets.
preload + includeSubDomainsexpand → migrate → contract)kms:DecryptEvery action on every secret is permanently recorded with cryptographic integrity guarantees. We can prove what happened — and prove nobody changed the record after the fact.
Every event is chained with SHA-256. Any modification to any record breaks the chain. There is no way to alter history without detection.
workspaceId from the JWTlz_<43 random chars> — stored as SHA-256 hash only, raw key shown to user oncehoneypot_triggered alert on useWe’re building toward the certifications enterprise buyers expect. Live status below.
All 17 FAR 52.204-21 practices implemented. CMMC Level 2 key controls (IA, AC, SC families) also implemented.
Continuous 6-month observation window underway. Trust Services Criteria mapped.
BAA available on request. AWS BAA in place for underlying infrastructure.
Targeting certification once SOC 2 lands. Same control overlap.
Independent third-party penetration test. Results summarized in the SOC 2 package.
For federal customers. Significant lift; pursued only with anchor customer commitment.
Full NIST 800-171 control implementation matrix → lockzero.io/compliance
A complete itemized breakdown of every data category we collect, how long we keep it, and the legal basis. No surprises for your DPA review.
| Data category | What exactly | Retention | Basis |
|---|---|---|---|
| Account identity | Email address, display name, Auth0 user ID, profile picture URL | For the life of the account + 30 days after deletion | Contract (account provisioning) |
| Workspace settings | Workspace name, plan tier, billing interval, feature flags, SAML/SCIM configuration | For the life of the workspace + 30 days after deletion | Contract |
| Secret metadata | Secret name, description, namespace, tags, rotation schedule, last-rotated timestamp — NOT the secret value | Until explicitly deleted by the workspace | Contract |
| Encrypted secret values | AES-256-GCM ciphertext only — the decryption key is held in AWS KMS and is never stored alongside the ciphertext | Until explicitly deleted by the workspace | Contract |
| Audit log | Actor (user ID or API key hash), action, affected entity, IP address, user agent, timestamp, result — never secret values | 365 days (default) · up to 7 years on Enterprise | Legitimate interest · Legal obligation |
| API keys | SHA-256 hash of the key, scopes, creation timestamp, last-used timestamp — raw key shown once at creation and never stored | Until revoked, then 30 days for audit trail | Contract |
| Session data | JWT claims, session revocation flags — stored ephemerally in Redis with a 30-day TTL | 30 days (refresh token lifetime) | Contract |
| Billing & subscription | Stripe customer ID, subscription status, invoice history, usage counters — no raw card data (Stripe holds that)* | 7 years (legal / tax obligation) | Legal obligation · Contract |
| AI proxy metadata | Model name, token counts, latency, status code, connector used — NOT prompt or response content (unless Traffic Inspector is enabled) | 90 days | Legitimate interest (abuse prevention, spend accounting) |
| Traffic Inspector captures | Redacted prompt + response bodies, only when Traffic Inspector is explicitly enabled by an admin in your workspace | 7 days (hard cap) | Contract (explicit opt-in) |
| Support correspondence | Email content you send to security@lockzero.io or support@lockzero.io | 2 years | Legitimate interest (support continuity) |
* Stripe stores and processes your payment card data under their own PCI DSS compliance. Lockzero never sees raw card numbers. Audit logs are retained for 365 days by default; Enterprise plans may configure extended retention up to 7 years.
These are hard architectural guarantees — not policy commitments. Each item is enforced by the code, not by a rule that an employee could bypass.
kms:Decrypt; every KMS call is independently logged in CloudTrailThird parties that may process Lockzero customer data. We list every one, including their certifications and what they have access to.
BackupVerification job — alerts on freshness gap > 25hdocs/RUNBOOK.md) covering DB down, tunnel down, Redis OOM, audit tamper, suspected breachFound a vulnerability? We respond within 48 hours and credit researchers in the security advisory.
security@lockzero.ioNo bug bounty yet — but every report gets a response, an acknowledgement, and credit.