What we do today, how we handle your data, and what is still on the roadmap — including the things procurement teams usually have to drag out of vendors.
This matrix is the fastest honest buying view. A current control is observable in the product or release path. A contract-required item must be agreed before client source or delivery activates. A roadmap item is not available today.
The platform is hosted on Netlify with TLS on every request: plain HTTP is redirected, and security headers are applied at the edge. Application roles constrain account-level operations. Formal enterprise identity, infrastructure access-review evidence, and independent control certification remain roadmap items rather than claims this page makes today.
Repository and bundle guards reject credentials in source code and public client assets. Runtime credentials are supplied through deployment environment configuration; release policy requires site-scoped least privilege and rotation after suspected exposure. No public page, screenshot, analytics event, or application response should contain a credential.
We collect what the platform needs to run and nothing more (see our privacy page). The healthcare track trains on mock and synthetic data — realistic enough to learn on, containing no real patients.
The platform does not accept PHI by default, and we ask you not to paste regulated data into lessons, artifacts, or the AI mentor. If your organization needs regulated-data workflows, that requires a separate enterprise agreement with explicit data terms — talk to us first.
Model-capable features call a configured provider only when that provider is available. Content submitted to a live assessment, prompt review, mentor, or artifact review may be processed under that provider's API terms. Scripted or offline fallbacks are labeled and cannot impersonate a verifying model result. Where providers offer API terms that exclude training on customer data, we choose them.
We do not use your artifacts to train third-party models without your explicit consent.
We do not currently hold a SOC 2 report, and we will not imply otherwise. The items below are in active planning. If your procurement process requires one of them today, email us — we will give you a straight answer on timing rather than a reassuring slide.
Audit program in planning. We do not hold a SOC 2 report today — current status available on request.
Enterprise identity integration for private programs, with provisioning.
Prepare standard data-processing agreements for enterprise counsel review.
Data residency options for buyers with jurisdictional requirements.
Found something? Email security@lockedinlabs.ai with a description and reproduction steps. We aim to acknowledge reports within two business days, and we will tell you what we are doing about it.
We do not run a paid bug bounty program today, but we credit researchers who report responsibly — with their permission.
This page is informational and does not constitute legal advice.
