Security and data handling

Lysnd is a small, founder-led company. We keep our setup simple: well-known managed providers for hosting, the database and payments, and strict rules in our own code about who can see what. This page explains those rules in plain English. It describes how we work today. It is not an independent audit or certification.

Our providers run the physical servers, network and managed database. We are responsible for how Lysnd is built and configured, including access rules, data handling and who on our side can reach your data. You are responsible for keeping your login safe and for who you invite into your workspace.

• The app runs on a global edge network and our database runs on a managed cloud platform. We do not operate our own servers.
• All traffic between your browser and Lysnd is encrypted in transit over HTTPS. Plain, unencrypted connections are not accepted.
• Our database provider encrypts stored data and backups at rest.

• Every table that holds customer data has database-level access rules. Each request is checked against your signed-in session, and you can only read or change data in accounts and workspaces you belong to.
• Inside an account, admins manage billing, members, projects and credits. Members work inside projects but cannot change billing or membership.
• Permissions are stored on our side and checked on our servers, never trusted from your browser.

• You can sign in with email and password or with Google. Passwords are never stored in readable form; our authentication provider stores only a one-way hash.
• New email accounts must confirm their address before signing in, and sign-ups from known throwaway email services are blocked.
• To limit abuse of the free plan, we count searches per network. We store only a one-way scrambled fingerprint of your IP address for this, never the address itself.

• Support work happens through a separate support area, limited to people we have given a support role.
• Support actions such as credit adjustments, plan changes and access changes are recorded in an audit log.
• We only look at your workspace content when you ask us to, when needed to fix a problem, or when the law requires it.
• Service keys and passwords for the tools we use are kept in an encrypted secrets store on the server and never sent to your browser.

Your account details, your workspaces and projects, the questions you ask, the public posts and reviews a search finds, the learnings and plans built from them, and your credit and billing history. Lysnd reads public sources only. It does not connect to your internal tools or customer records unless you paste that information in yourself. The full list is in our Privacy Policy.

• We use AI models to group signals into learnings and to draft plans and business cases. Your content is sent to the model only to produce your result.
• We do not use your questions, workspace data or plans to train AI models, and our AI provider does not use them to train its models.

Payments are handled by Stripe, a PCI DSS Level 1 certified processor. Your card details go straight to Stripe and never touch or get stored on our servers. We only keep a record of your plan, invoices and payment status.

We rely on a small set of providers, each limited to its job:

• Hosting and database — run the app, store your data, handle sign-in.
• AI processing — group signals and draft plans.
• Public web search and collection — find public posts and reviews for your searches. They receive search terms, not your account data.
• Email delivery — send account, alert and support emails.
• Payments — Stripe, for billing.

You can ask for the current named list at any time by emailing support@lysnd.io.

• Deleting a project removes its research, learnings and plans right away.
• When an account is closed, we delete its data within 30 days.
• Backup copies roll off within 90 days.
• Some records, such as billing history, are kept longer where the law requires. Details are in our Privacy Policy.

If we learn of a security incident that affects your personal data, we will look into it promptly, contain it, and tell affected customers without undue delay, as required by law.

If you think you have found a security issue, email support@lysnd.io with the subject "Security Report" and enough detail for us to reproduce it. We aim to reply within two business days.

When testing, please:

• Only use accounts you own, and never access other people's data.
• Avoid anything that slows down or disrupts the service.
• Give us reasonable time to fix the issue before sharing it publicly.

We will not take legal action against anyone who reports in good faith and follows these rules. We do not currently run a paid bug bounty.

Lysnd does not currently hold its own SOC 2 or ISO 27001 certification. Our payment processor is PCI DSS Level 1 certified, and our major hosting providers maintain their own industry certifications. If you need a security questionnaire answered or specific contract terms, email support@lysnd.io and we will tell you plainly what we can and cannot support today.

See our Privacy Policy, Cookie Notice and Terms of Service.