Security at Assetlens

Authentication is handled by Clerk, an enterprise-grade identity platform with SOC 2 Type II certification, supporting SSO, MFA, and device management.

All accounts can enable TOTP-based MFA. Enterprise plans can enforce MFA at the organisation level.

Assetlens supports owner, admin, and member roles within organisations. Admins can revoke member access at any time.

Sessions are short-lived JWT tokens. Tokens are rotated on sensitive operations and expire after 24 hours of inactivity.

All data transmitted between your browser and Assetlens servers is encrypted using TLS 1.3, the latest and most secure version of the protocol.

Database data, uploaded files, and cached renders stored in Neon DB and Vercel Blob are encrypted at rest using AES-256.

We never store your payment card numbers. All payment data is tokenised and stored by Stripe, a certified PCI-DSS Level 1 service provider.

API keys and credentials are stored as encrypted Vercel environment secrets and are never exposed to client-side code.

Assetlens runs on Vercel's global edge network with automatic DDoS mitigation and geo-distributed CDN caching.

Our serverless functions have a minimal attack surface and scale automatically, reducing exposure to traditional server-level vulnerabilities.

Every database query scopes results to the authenticated user's organisation. Cross-tenant data access is architecturally prevented at the query level.

Neon DB provides continuous point-in-time recovery (PITR) with backups retained for 7 days. Critical data can be restored within minutes.

Runtime errors are captured and alerted to our engineering team via Sentry with full stack traces. No personally identifiable information is included in error payloads.

All incoming webhooks from Stripe and Lob are verified using cryptographic signatures before processing.

We use automated dependency auditing to detect and patch known vulnerabilities in our open-source dependencies.

Third-party API keys are scoped to the minimum permissions required. No global admin keys are used in production.