Security at LaunchSafe
Our products read source, cloud and runtime — so how we build, what we hold, and who can see it matter before anything is connected. This is our posture as a company, and how to reach us if you find something wrong.
launchsafe.com/security
Your code and runtime data never trains our models. Customer code, configuration, findings and runtime telemetry are never used to train or fine-tune any model. Our products are built to run in your VPC or a region you nominate.
How we build
Link to “How we build”- Encryption
- Data is encrypted in transit and at rest.
- Tenancy
- Tenant isolation by design, with least-privilege access internally.
- Authentication
- SSO and MFA on internal and product access.
- Development
- A secure SDLC, with third-party penetration testing.
Compliance
Link to “Compliance”We have not completed a SOC 2 audit. We build to a SOC 2 Type II control set and support GDPR and UK GDPR obligations through our Data Processing Agreement, which lists our sub-processors and the transfer mechanisms we rely on. We will complete your security questionnaire on request — email hello@launchsafe.com.
Reporting a vulnerability
Link to “Reporting a vulnerability”Email hello@launchsafe.com with “Security” in the subject line. Our disclosure policy sets out scope, safe harbour for good-faith research and our response times, and our security.txt carries the same contact. We do not run a paid bounty programme.