# Security and data protection practices > How Lemma protects accounts and skill evidence: infrastructure, encryption, access controls, signed Passports, analytics, and how to report a vulnerability. Source: https://getlemma.io/security How we protect your account, your skill evidence and your data, described as it is built today. Where something is still on the roadmap, we say so. ![Painting of white chalk cliffs above a sunlit turquoise bay](https://cdn.sanity.io/images/islu4peo/production/cc8e7b117ab74c8f822a2cb5bc3bf16b0739c115-1680x945.jpg?w=1080&fm=webp&q=68&fit=max) Security overview Today - HTTPS everywhere HSTS · secure WebSockets On - Signed Passports Ed25519 · checkable by anyone On - Secrets encrypted AES-256-GCM · keys stored as hashes On - Card details Entered on Stripe, never reach Lemma Stripe - SOC 2 audit On the roadmap Not yet ## Infrastructure The services Lemma runs on, and what each one is responsible for. ### Managed PostgreSQL Accounts, evidence and ledger data live in PostgreSQL on Neon. Development, test and production use separate database branches. ### Persistent API servers The Lemma API runs on Railway as a long-running service, not as serverless functions, which keeps realtime connections and background jobs in one controlled process. ### Web hosting The Lemma app and this website are served by Vercel over HTTPS. ### File storage Uploaded files are stored in S3-compatible object storage on Cloudflare R2. Uploads use short-lived signed URLs rather than open buckets. ### Sign-in Sign-in is handled by Firebase Authentication. Lemma never stores your password. ### Payments Payments go through Stripe Checkout. Card details are entered on Stripe and never reach Lemma's servers. ## Encryption Encrypted in transit, encrypted at rest, and an extra layer for the secrets that matter most. ### In transit - All web and API traffic is served over HTTPS - HSTS tells browsers never to fall back to plain HTTP - Realtime connections run over secure WebSockets (WSS) ### At rest - Database and file storage are encrypted at rest by our providers - Calendar connection tokens are encrypted with AES-256-GCM before storage - Passport signing keys are stored encrypted with AES-256-GCM - API keys and admin session tokens are stored only as SHA-256 hashes ## Access controls Three separate ways in: members, API clients and internal staff, each with its own controls. ### Session cookies After you sign in, the app keeps your session in an HTTP-only cookie that page scripts cannot read. State-changing requests are checked against cross-site request forgery. ### Request protection The API sends a strict Content Security Policy and HSTS, accepts browser requests only from an allowlist of Lemma origins, and rate-limits every client. ### Scoped API keys Keys for the verification API carry explicit scopes, such as reading verification results or sending assessment invites, are tagged live or sandbox, and can be revoked. ### Separate admin access Internal staff use a separate admin account system with role-based permissions. Admin actions are written to an audit log. ## Integrity of skill evidence A record is only useful if a viewer can trust that it has not been quietly changed. ### Signed Passports Each Passport document is signed with an Ed25519 key when it is issued, so a verifier can check that it came from Lemma and has not been edited since. ### Append-only evidence Evidence is never silently rewritten. Corrections, revocations and disputes are recorded as new entries, so the history of a record stays visible. The [methodology](https://getlemma.io/methodology) explains how records are formed. ## Your data What we collect to run Lemma, what we do not, and how you stay in control of it. ### Website analytics only with your consent getlemma.io loads no analytics or advertising script until you opt in. With Analytics on, it uses PostHog (EU) and Google Analytics, and session replays mask everything you type; with Marketing on, it measures Google Ads conversions. The chat assistant sends what you type to OpenAI, directly or through Vercel's AI Gateway, and Lemma does not store the conversation. ### Minimal analytics in the app With the same consent, the Lemma app sends page views and a short list of product events, such as signing up or booking a session, to PostHog in the EU. Events are tied to an internal user ID only, and session recording is switched off in the app. One choice covers the website and the app. ### Error monitoring Sentry captures application errors so we can fix them. Cookies are stripped from API error reports before they are sent. ### Export and deletion You can export your data or delete your account from the app's settings. The [privacy policy](https://getlemma.io/legal/privacy) and [subprocessor list](https://getlemma.io/legal/subprocessors) cover the details. ## Report a vulnerability If you find a security issue, email [security@getlemma.io](mailto:security@getlemma.io?subject=Security%20report) and give us a reasonable chance to fix it before you publish. Include the steps to reproduce and the impact you observed. Our [security.txt](https://getlemma.io/.well-known/security.txt) has the same details. We do not run a paid bug bounty programme at the moment. ## Certifications Lemma does not hold a SOC 2 or ISO 27001 certification today. SOC 2 is on our roadmap, and we will publish it here when an audit is complete. If a security incident affects your data, we will tell you and, where the law requires it, the relevant data protection authority. ![Painting of an olive grove in soft sunlight with hills beyond](https://cdn.sanity.io/images/islu4peo/production/613eb3f93566423c9adf45246f2cf1a61437c04c-1680x1120.jpg?w=1080&fm=webp&q=68&fit=max) ## Questions this page does not answer? Security reviews, questionnaires and data processing questions go to the same inbox, and a person answers. [security@getlemma.io](mailto:security@getlemma.io)[How evidence is checked](https://getlemma.io/methodology)