Security

Credentials

API keys, tokens, passwords and SSH keys that you give Ladeworks are encrypted at rest with AES-256-GCM before they are stored. After you save one, the app shows only a masked hint, such as the last four characters. The full value is never sent back to your browser.

Downloads of requests and responses from run details strip sensitive headers, such as Authorization, API key headers and cookies.

Requests to your systems

Every request Ladeworks makes to a customer system goes through one gateway. It blocks connections to private and internal network addresses, checked again after DNS lookups and after every redirect, so Ladeworks cannot be used to reach internal services. It also applies timeouts, a cap on redirects and response size, and per-integration rate limits.

Outbound requests come from a small, stable set of IP addresses that you can allowlist.

Accounts and sessions

• Passwords are hashed with argon2id. We never store the plain password.
• You can turn on two-factor authentication with an authenticator app (TOTP). Recovery codes are stored as hashes. The owner of a workspace can require two-factor sign-in for everyone in it, including people who log in with Google.
• Sessions are stored on the server. The session cookie is HttpOnly, Secure and SameSite=Lax, and the stored session token is hashed.
• Sign-in attempts are throttled per email and address, and password reset and sign-up requests are rate limited.
• Requests that change data must carry a custom header that other websites cannot add, which blocks cross-site request forgery.
• Webhooks can require a secret header, and outgoing webhooks are signed.

Roles and access

Every workspace member has a role: Owner, Admin, Editor or Viewer. The server checks the role on each request. Every data query is scoped to the workspace. Seeing payloads (the records inside runs) is a separate permission that is set per member. The Owner always has it.

Browser protections

The app and the website send a strict Content Security Policy and HSTS, plus headers that block framing, content type sniffing and unneeded browser features. The app runs no inline scripts.

Data handling and deletion

Run history, responses, payloads and output files are deleted automatically after your plan's retention period (3 to 90+ days, depending on the plan). Workspace data is deleted when a workspace is deleted. Payloads are not encrypted separately from the rest of the database in this version.

Files and result sets are streamed in pages and not loaded whole into memory.

What we do not claim

Ladeworks does not hold any security certifications or audit reports at this time, and we do not claim any. If you need a security review, email security@ladeworks.com and we will answer your questions directly.

Report a vulnerability

If you find a security problem, email security@ladeworks.com with what you found and how to reproduce it. We will reply, investigate and keep you updated.

Please give us reasonable time to fix the issue before you share it, test only against accounts you own, and do not access, change or delete other people's data. We will not take action against people who follow these rules in good faith.