Security and trust
You are handing us your unfixed accessibility findings.
That is a list of exactly where your products fall short, sometimes alongside documents containing client information. We treat it accordingly, and we are direct about what is in place today versus what is coming.
Where we stand today
No certification theatre. If something is in progress we say in progress, so you can weigh it against your own risk appetite.
In place
Encryption in transit
HTTPS on every connection, with plain HTTP redirected before any of our code runs. TLS 1.3 between our application and our database.
In place
Credentials encrypted before they are stored
Captured browser sessions, site gate passwords, and crawler credentials are encrypted with AES-256-GCM before they are written. The key lives in the application environment, never in the database, so a copy of the database on its own does not yield them.
In progress
Encryption at rest below the application
Our database and file storage sit on managed infrastructure, and disk encryption there is our provider’s to implement and attest. We rely on it, we cannot verify it from our own code, and we would rather hand you the provider’s attestation than paraphrase it as our own control.
In place
Canadian data residency
Primary hosting in Canada. Available as a contractual commitment on Enterprise.
In place
Work-account sign-in and verified-domain join
Sign in with a Microsoft or Google work account. Prove you own an email domain with a DNS record, and anyone signing in with a confirmed address there joins your workspace at the role you set, with no per-user invitation.
In place
Directory provisioning through SCIM
Microsoft Entra, or any SCIM 2.0 client, adds people at your verified domains and removes leavers. Removal ends the seat and every session at once; their name and history stay, and you can let them back in. Users only: access levels come from the role you set, not from directory groups.
In progress
SAML federation
Not built yet. Sign-in is a Microsoft or Google work account, not a SAML connection to your tenant, so it cannot yet be restricted to your identity provider alone or replace passwords for your people. We would rather say that than let you find out at implementation.
In progress
Audit history
Changes to a finding are recorded, and you can see them on that finding’s timeline. Reads are not recorded: the table exists and nothing writes to it, so we cannot tell you who opened an audit. Exports are not recorded either, and the history itself cannot be exported yet. Nothing expires these records.
In place
Backups documented
The database is backed up daily and the seven most recent daily backups are kept. Point-in-time recovery is not enabled, so the smallest restorable unit is a whole day. Deleting data removes it from the live system, and a copy may persist in a backup for up to seven further days before it ages out. Backup encryption is our hosting provider's to attest; we rely on it rather than claim it.
In progress
SOC 2 Type II
Readiness work underway. We will publish the report date when it is set rather than implying we hold one.
In progress
Penetration testing
First third-party test scheduled. The summary letter will be available under NDA once complete.
What we store, and what we do not.
The shortest version: we keep what is needed to show a finding and prove it was fixed, and nothing beyond that.
| Data | Stored | Retention |
|---|---|---|
| Page markup and screenshotsThe evidence behind each finding | Yes | In place While any finding on it is open, then 12 months. A daily job strips the markup and deletes the images, and keeps the finding and the verdict. |
| Uploaded documentsWord, Excel, PowerPoint, PDF | Yes | In progress Until the workspace is deleted, which removes them and their stored files. There is no per-document delete in the product yet. Ask us and we will remove one. |
| Findings and verdictsIncluding who signed off and when | Yes | In place Life of the account, for the compliance trail |
| Captured session for auth testingA browser session you capture and hand over | Encrypted | In place Deleted 30 days after it was last used, or sooner if you revoke it. The deletion is logged. |
| A site gate passwordOne field, and only if you configure one | Encrypted | In progress Until you remove it or close the account. Nothing expires it on a timer yet, and we have not set a period rather than publish one nothing honours. |
| Passwords for your internal systemsIdentity provider, admin consoles, real user accounts | No | In place We do not ask for or accept these |
| Analytics on your end usersNo individual shopper, customer, or order data, ever | Read, not kept | In place In the Shopify app we read aggregate store totals for the last 30 days: sales, orders, average order value, sessions, conversion rate, and the checkout funnel. Fetched when you open the screen, shown next to the finding so you can prioritize, never written to our database or logs. |
| Free test inputsTested without an account | Yes, briefly | In place The IP address for one hour, held only to rate limit the endpoint. The scan and its result for 24 hours after the result is first shown, so a link opened later that day still works, and at most seven days. |
This table used to say the free test stored nothing, and that a password was never accepted.Neither was true. Free test inputs were written to the same tables as any other scan, and a single site gate password is accepted where you choose to configure one. Both rows are corrected above, and the periods are now carried out by a scheduled job rather than stated and left. The full account is on theprivacy page.
AI and your content
Your content is not training data.
limena uses AI to explain findings and draft fixes, which means content from your pages and documents is sent to a model provider.
This is the question every security reviewer asks, so here are the specifics rather than a reassurance.
No training on your data
We use enterprise API tiers with training disabled by contract. Your content is not used to improve any model, ours or the provider’s.
Only what the finding needs
The relevant element and its surrounding context, not the whole page or document. We do not bulk-send your content.
Providers are named
Our sub-processor list is published and versioned. If it changes, existing customers are notified before the change takes effect.
You can turn it off
AI explanations can be disabled per workspace. limena still detects and routes findings, you just get the standard criterion wording instead.
AI never signs off conformance
A judgment call is always recorded against a person. This is a product principle, not only a security control.
Access, authentication, and the awkward one.
Testing an authenticated app means limena needs to get in. How that works matters more than any certificate.
Sessions, and one exception
For authenticated testing you capture a browser session and hand limena that. The exception is a site gate: one field in front of a staging site or a Shopify storefront. If you configure that password we store it encrypted and submit it to reach the page. We do not ask for credentials to your identity provider, your admin consoles, or a real user account.
Read-only by default
limena reads your product. Write access exists only where you explicitly connect a tracker to open tickets, or a repository to open fix pull requests, and it is scoped to that.
Use a test account
We recommend a dedicated non-production account with representative permissions rather than a real user. Findings are identical.
Role-based access on your side
Unlimited seats does not mean unlimited visibility. Roles control who sees findings, evidence, and exports within your workspace.
For your security review
Send the questionnaire.
We would rather answer a real assessment than publish a badge. Send yours and we will complete it, including the questions where the answer is not yet.
Contact securityAvailable on request
- Security questionnaire, completedOn request
- Sub-processor listPublished
- Data processing agreementOn request
- Architecture and data flow summaryUnder NDA
- Penetration test summaryWhen complete
Under NDA where appropriate. Enterprise agreements can include a security addendum and a defined incident notification window.
Questions we have not answered here?
Ask directly. We will give you a straight answer, including where the answer is that we are not there yet.