Home / Trust
Inspect every control.
The current state of our security and compliance work: what is implemented, what is in progress, and what still needs to be validated in your deployment.
Deployment model
Keep data in your boundary.
Lians is self-hostable by design. In the reference deployment, memories, embeddings, and audit events remain in infrastructure you operate. Assess the actual configuration with your security team.
Run the Apache-2.0 engine on your own Postgres. You choose where sensitive data, keys, and logs are processed and retained.
Hard-fails any configuration that would send data to an external service.
Embedded SQLite, fully in-process. No server, no network surface.
Operational responsibility and data boundaries differ from self-hosted; review the final service scope and controls before use.
Compliance status
Current, dated, no adjectives.
| Item | Status | Notes |
|---|---|---|
| SOC 2 Type 1 | In progress | Current status and control documentation available under NDA; ask security@lians.ai. |
| GDPR Art. 17 erasure | Feature mapping | Per-subject crypto-shred and an erasure record are implemented. Your controller obligations and retention policy still apply. Mapping → |
| SEC 17a-4 / WORM | Feature mapping | An append-only SHA-256 audit chain supports evidence review; it is not a certification or legal conclusion. Mapping → |
| HIPAA | Feature mapping | Self-hosted deployments can use patient-scoped encryption and access barriers. A covered entity must validate its own configuration and agreements. |
| Independent review | Customer review supported | The engine is public. Review the threat model and security whitepaper on GitHub ↗ before deployment. |
Encryption
Encrypt every layer.
AES-256-GCM under a per-subject key, wrapped by a master key from your KMS.
TLS everywhere; HSTS with preload on the managed surface.
API keys stored only as SHA-256 hashes, namespace-scoped, individually revocable.
Destroying a subject's key renders their content permanently unreadable; hashes and timestamps survive for the examiner.
Subprocessors
See every dependency.
These apply to the managed cloud and this website only. Self-hosted deployments have no subprocessors. That's the point.
| Subprocessor | Purpose | Data touched |
|---|---|---|
| Fly.io | Managed cloud hosting (app + database) | Customer memory data (managed cloud only), encrypted at rest |
| Vercel | Website and console hosting | Site traffic metadata |
| Clerk | Console authentication | Account email, session data |
| Stripe | Billing | Payment details (never stored by Lians) |
| Sentry | Error telemetry for the website | Error traces; no memory content |
Security disclosure
Report a problem.
security@lians.aiacknowledgement within 48 hourscoordinated: we fix, then publish in the changelog with credit