Home / Trust
We sell compliance. Here's ours.
The current, honest state of our security and compliance posture: what's certified, what's in progress, and what's architecturally guaranteed.
Deployment model
The strongest guarantee: your data never reaches us.
Lians is self-hostable by design: the recommended deployment keeps every memory, embedding, and audit event inside your own perimeter. No telemetry, no phone-home.
Run the Apache-2.0 engine on your own Postgres. PII, PHI, and MNPI never leave your infrastructure.
Hard-fails any configuration that would send data to an external service.
Embedded SQLite, fully in-process. No server, no network surface.
Zero ops, with the same encryption and audit posture as self-hosted.
Compliance status
Current, dated, no adjectives.
| Item | Status | Notes |
|---|---|---|
| SOC 2 Type 1 | In progress | Current status and control documentation available under NDA; ask security@lians.ai. |
| GDPR Art. 17 erasure | Architectural | Per-subject crypto-shred with erasure certificate; audit trail preserved. Mapping → |
| SEC 17a-4 / WORM | Architectural | Append-only SHA-256 audit chain; point-in-time reconstruction for examiners. Mapping → |
| HIPAA | Architecture-aligned | Self-hosted keeps PHI in your perimeter; patient-scoped encryption and access barriers in the engine. |
| Penetration testing | Open source | The full engine is public. Audit it before you deploy it. Threat model and security whitepaper on GitHub ↗. |
Encryption
Encrypted at rest, in transit, per subject.
AES-256-GCM under a per-subject key, wrapped by a master key from your KMS.
TLS everywhere; HSTS with preload on the managed surface.
API keys stored only as SHA-256 hashes, namespace-scoped, individually revocable.
Destroying a subject's key renders their content permanently unreadable; hashes and timestamps survive for the examiner.
Subprocessors
A short list, and how to make it zero.
These apply to the managed cloud and this website only. Self-hosted deployments have no subprocessors. That's the point.
| Subprocessor | Purpose | Data touched |
|---|---|---|
| Fly.io | Managed cloud hosting (app + database) | Customer memory data (managed cloud only), encrypted at rest |
| Vercel | Website and console hosting | Site traffic metadata |
| Clerk | Console authentication | Account email, session data |
| Stripe | Billing | Payment details (never stored by Lians) |
| Sentry | Error telemetry for the website | Error traces; no memory content |
Security disclosure
Found something? Tell us directly.
security@lians.aiacknowledgement within 48 hourscoordinated: we fix, then publish in the changelog with credit