Security · LUPO
Security
Security at LUPO is led by Tom Baxter. Report anything you find to security@lupolabs.ai.
01 · Report
Report a vulnerability
Found an issue in lupolabs.ai, river.lupolabs.ai or the River API? Email security@lupolabs.ai with what you found, the steps to reproduce it and the URL or endpoint involved.
- ScopeTest only against your own account and your own data.
- Hands offDo not access, change or delete anyone else's data.
- DisclosureGive us reasonable time to fix the issue before you share it publicly.
We reply to every report and keep you updated until the issue is fixed.
02 · Data
How River-1 protects data
- No poolingA customer's signup data is never pooled with another customer's.
- DeletionEach lookup is deleted after a fixed retention period, and sooner on request.
- Opt outAnyone can ask to be left out. An address on the do not process list is never looked up.
- IP addressesCut to the network and hashed on arrival. The full address is never stored.
- WebhooksSigned with HMAC-SHA256. The signing secret is shown once.
- TransportThe River API is served over HTTPS only.
03 · Contact
Contact
Security: security@lupolabs.ai. Privacy and data requests: privacy@lupolabs.ai.
Machine-readable: /.well-known/security.txt