Security

Security approach

Luca Technologies uses layered safeguards across application access, infrastructure, storage, and operations. Controls are reviewed as the product and its risks change. This page describes current practices and is not a certification or guarantee that every threat can be prevented.

Application and account protection

• Passwords are stored using a modern password hashing algorithm.
• Authentication uses random, opaque session identifiers; stored session records use token hashes rather than the raw cookie value.
• Production cookies use HttpOnly, Secure, and SameSite protections.
• Multi-factor authentication is available for administrative access.
• Organization and role permissions restrict access to authorized users and actions.
• Audit and authentication event records support security review and incident investigation.

Data and infrastructure

• Production traffic is encrypted in transit using HTTPS.
• Managed infrastructure, database, object storage, and email providers are used for service delivery.
• Sensitive project-vault content is protected separately from ordinary file metadata and access is checked by the application.
• Security headers, origin restrictions, input validation, request rate controls, and dependency review reduce common web risks.

Customer responsibilities

Customers should use unique passwords, enable multi-factor authentication where offered, protect invited accounts, keep devices and browsers current, grant only needed access, and promptly report suspicious activity. Sensitive information should only be uploaded to an area intended for it.

Report a security issue

If you believe you found a vulnerability or security incident, email contact@lucatechs.com with a clear description, affected URL, reproduction steps, and any supporting evidence. Please do not access data that is not yours, disrupt the service, use destructive testing, or publish an issue before we have had a reasonable opportunity to investigate and address it.