Security at Lutril
Lutril governs access for a living; the bar for our own security is the one we sell. This page summarizes how the platform is built, tested, and operated.
Application security
- Static application security testing (SAST) runs on every code change before it can ship.
- Dynamic application security testing (DAST) runs against the platform to catch what static analysis cannot.
- Dependencies and container images are scanned continuously; supply-chain policies gate what enters the build.
- Changes are peer-reviewed and deployed through controlled, audited procedures.
Penetration testing
Independent third parties test the platform from both sides: blackbox (no prior knowledge, like a real attacker) and whitebox (full source access, deeper coverage). The latest reports are available to customers and prospects under NDA; request them at security@lutril.com.
Infrastructure
- Production is hosted in the EU (OVHcloud, France) with Cloudflare at the edge: WAF, DDoS mitigation, and TLS termination.
- Encryption in transit (TLS) and AES-256 at rest for production data stores.
- Daily backups, encrypted at rest, tested for restorability.
- Customer workspaces are logically isolated; data is never shared across tenants.
- Our two subprocessors are listed on the Subprocessors page.
Access & operations
- Role-based access control and least-privilege operations across the team.
- MFA is required for privileged Lutril accounts.
- Administrative and support access is granted only when operationally necessary, and logged.
- We run Lutril on Lutril: access reviews, offboarding, and agent governance apply to our own stack first.
Compliance
Lutril operates its security program against the SOC 2 Type II trust services criteria and ISO 27001 controls. Access review campaigns, audit trails, and evidence exports in the product are built to satisfy the same frameworks for our customers.
Incident response & disclosure
- Documented incident response procedures, with customer notification of confirmed incidents involving customer data per contractual and legal requirements.
- Found a vulnerability? Report it to security@lutril.com. We acknowledge reports quickly and keep reporters informed through remediation.
Our latest blackbox and whitebox penetration test reports are available under NDA, along with our security questionnaire answers.
Controls aligned with SOC 2 Type II and ISO 27001