Security at LimeStone

Infrastructure

All LimeStone products run on Google Firebase and Cloudflare — platforms with independent security certifications (SOC 2 Type II, ISO 27001). We do not operate our own servers.

Data Protection

• Encryption in transit: TLS 1.2+ on all connections.
• Encryption at rest: AES-256 via Google Firebase.
• Data isolation: Firestore security rules ensure each user can only access their own workspace.
• Least privilege: We request only the minimum permissions needed for each feature.

Authentication

Login is handled by Firebase Authentication. Supports Google OAuth and email/password. Sessions are tokenised and expire automatically. Access requires administrator approval.

Responsible Disclosure

If you discover a security vulnerability in any LimeStone product, please report it privately before public disclosure.

Contact: contact@lsaws.com
Subject: Security Vulnerability Report

We acknowledge all reports within 3 business days and resolve critical issues within 14 days. We credit researchers who disclose responsibly (with their consent).

Incident Response

In the event of a security incident affecting user data, we will contain the issue immediately, investigate the scope and cause, notify affected users within 72 hours, and publish a post-mortem for significant incidents.