Security at Lemma
How we protect your account, your skill evidence and your data, described as it is built today. Where something is still on the roadmap, we say so.
- On
HTTPS everywhere
HSTS · secure WebSockets
- On
Signed Passports
Ed25519 · checkable by anyone
- On
Secrets encrypted
AES-256-GCM · keys stored as hashes
- Stripe
Card details
Entered on Stripe, never reach Lemma
- Not yet
SOC 2 audit
On the roadmap
Infrastructure
The services Lemma runs on, and what each one is responsible for.
Firebase
Auth
Vercel
Web apps
Stripe
Checkout
Railway
Lemma API
Neon
PostgreSQL
Separate branches
Cloudflare R2
File storage
No open buckets
Managed PostgreSQL
Accounts, evidence and ledger data live in PostgreSQL on Neon. Development, test and production use separate database branches.
Persistent API servers
The Lemma API runs on Railway as a long-running service, not as serverless functions, which keeps realtime connections and background jobs in one controlled process.
Web hosting
The Lemma app and this website are served by Vercel over HTTPS.
File storage
Uploaded files are stored in S3-compatible object storage on Cloudflare R2. Uploads use short-lived signed URLs rather than open buckets.
Sign-in
Sign-in is handled by Firebase Authentication. Lemma never stores your password.
Payments
Payments go through Stripe Checkout. Card details are entered on Stripe and never reach Lemma's servers.
Encryption
Encrypted in transit, encrypted at rest, and an extra layer for the secrets that matter most.
Browser
Lemma app
Lemma API
On Railway
PostgreSQL
Accounts, evidence, ledger
- Calendar tokensAES-256-GCM
- Signing keysAES-256-GCM
- API keysSHA-256 hash
- Admin sessionsSHA-256 hash
File storage
Uploaded files
- Uploadssigned URLsshort-lived
- Bucketsnot public
In transit
- All web and API traffic is served over HTTPS
- HSTS tells browsers never to fall back to plain HTTP
- Realtime connections run over secure WebSockets (WSS)
At rest
- Database and file storage are encrypted at rest by our providers
- Calendar connection tokens are encrypted with AES-256-GCM before storage
- Passport signing keys are stored encrypted with AES-256-GCM
- API keys and admin session tokens are stored only as SHA-256 hashes
Access controls
Three separate ways in: members, API clients and internal staff, each with its own controls.
Alex Chen
Member
HTTP-only cookieCSRF checkOrigin allowlistHiring app
API client
lm_live_8kQ…verify_readPer-key limitAna P.
Staff · support role
Admin accountRole checkAudit log
Audit log
Today- Viewed session history14:05
- Opened support ticket14:02
- Signed in to admin13:48
Session cookies
After you sign in, the app keeps your session in an HTTP-only cookie that page scripts cannot read. State-changing requests are checked against cross-site request forgery.
Request protection
The API sends a strict Content Security Policy and HSTS, accepts browser requests only from an allowlist of Lemma origins, and rate-limits every client.
Scoped API keys
Keys for the verification API carry explicit scopes, such as reading verification results or sending assessment invites, are tagged live or sandbox, and can be revoked.
Separate admin access
Internal staff use a separate admin account system with role-based permissions. Admin actions are written to an audit log.
Integrity of skill evidence
A record is only useful if a viewer can trust that it has not been quietly changed.
The Passport document is signed
Checked today, 10:41
Signature valid
Issued by Lemma
Unchanged since it was signed
Matches the signed version
2 corrections in the evidence log
Added as new events, originals kept
Signed Passports
Each Passport document is signed with an Ed25519 key when it is issued, so a verifier can check that it came from Lemma and has not been edited since.
Append-only evidence
Evidence is never silently rewritten. Corrections, revocations and disputes are recorded as new entries, so the history of a record stays visible. The methodology explains how records are formed.
Your data
What we collect to run Lemma, what we do not, and how you stay in control of it.
getlemma.io
Analytics or ad scripts
Product events
PostHog · EU- Booked a sessionuser_7f3a9111 Oct, 09:02
- Booked a sessionuser_7f3a919 Oct, 12:15
- Signed upuser_7f3a912 Sep, 18:40
Website analytics only with your consent
getlemma.io loads no analytics or advertising script until you opt in. With Analytics on, it uses PostHog (EU) and Google Analytics, and session replays mask everything you type; with Marketing on, it measures Google Ads conversions. The chat assistant sends what you type to OpenAI, directly or through Vercel's AI Gateway, and Lemma does not store the conversation.
Minimal analytics in the app
With the same consent, the Lemma app sends page views and a short list of product events, such as signing up or booking a session, to PostHog in the EU. Events are tied to an internal user ID only, and session recording is switched off in the app. One choice covers the website and the app.
Error monitoring
Sentry captures application errors so we can fix them. Cookies are stripped from API error reports before they are sent.
Export and deletion
You can export your data or delete your account from the app's settings. The privacy policy and subprocessor list cover the details.
Report a vulnerability
If you find a security issue, email security@getlemma.io and give us a reasonable chance to fix it before you publish. Include the steps to reproduce and the impact you observed. Our security.txt has the same details.
We do not run a paid bug bounty programme at the moment.
Certifications
Lemma does not hold a SOC 2 or ISO 27001 certification today. SOC 2 is on our roadmap, and we will publish it here when an audit is complete.
If a security incident affects your data, we will tell you and, where the law requires it, the relevant data protection authority.
Questions this page does not answer?
Security reviews, questionnaires and data processing questions go to the same inbox, and a person answers.