Security & Responsible Disclosure

Security is foundational to everything Lacspace builds. We apply defence-in-depth across our platforms and continuously improve our controls. This page describes how we protect your data and how security researchers can report issues to us responsibly.

• Tenant isolation — every record carries a tenant; every query filters by it, so customers' data is separated by design.
• Encryption — data is encrypted in transit; sensitive data is protected at rest.
• Access control — least-privilege, role-based access with authentication and session management.
• Audit logging — append-only logs record who did what, when, and where.
• Monitoring — we monitor for anomalies and respond to incidents.

We process personal data in line with our Privacy Policy, apply data-minimisation, and support consent and deletion. For regulated data (such as health records), we apply heightened safeguards and honour applicable retention and localisation obligations.

We welcome reports from security researchers. If you believe you have found a vulnerability in a Lacspace Service, please report it privately and give us reasonable time to fix it before any public disclosure. Please act in good faith, avoid privacy violations and service disruption, and never access or modify data that is not yours.

In scope are Lacspace-owned production Services and domains. Please avoid testing that could harm users or data — no denial-of-service, spam, social engineering of our staff or customers, or physical attacks. If you are unsure whether something is in scope, ask us first.

If you make a good-faith effort to comply with this policy during your research, we will consider your actions authorised, will not pursue legal action against you for that research, and will work with you to understand and resolve the issue quickly. This safe harbor does not apply to actions that harm users, breach privacy, or violate the law.

• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing best-practice headers or configurations with no real security impact.
• Social engineering, physical access, or attacks requiring a compromised device.
• Denial-of-service, rate-limit, or volumetric issues.

Email security@lacspace.com with:

• a clear description of the issue and the affected Service or URL;
• steps to reproduce, proof-of-concept, and potential impact;
• your contact details so we can follow up.

We aim to acknowledge reports promptly, validate and triage them, keep you updated on remediation, and confirm when a fix is deployed. Timelines depend on severity and complexity, and we appreciate your patience and coordination on disclosure timing.

We are grateful to researchers who help keep our users safe. With your permission, we are happy to acknowledge valid, first-report contributions. Any reward is at our discretion and depends on impact and report quality.

Reach our security team at security@lacspace.com. For privacy matters, contact privacy@lacspace.com.