Security & Compliance

LockUp takes the security of customer data seriously. This page describes our current posture honestly — what we have today, what is in flight, and where we rely on certified subprocessors. We would rather be useful and honest than fluent in compliance theatre.

Subprocessors

All of our subprocessors hold SOC 2 Type II or PCI DSS Level 1 attestations, or both:

• Vercel — US hosting & edge network. SOC 2 Type II.
• Neon — US Postgres database. SOC 2 Type II.
• Clerk — user authentication & session management. SOC 2 Type II.
• Stripe — payment processing. PCI DSS Level 1.
• Anthropic — AI fix generation. SOC 2 Type II. Customer data is not used to train models.
• Etherscan — public smart-contract source lookups (no PII transmitted).

What we have today

• Hosted on SOC 2 Type II infrastructure
• TLS 1.3 in transit; AES-256 at rest (via Neon's default encryption)
• MFA available on all admin accounts via Clerk
• Customer data isolated per tenant in the application layer
• Card data: never touches LockUp servers. All payments are handled by Stripe Checkout.
• SSRF protection on every external scan path (DNS resolution + resolved-IP private-range checks)
• Stripe + Clerk webhook signature verification on every event
• Published vulnerability disclosure policy at /.well-known/security.txt

In progress

• Published Data Processing Agreement (DPA) for EU customers
• Documented Incident Response runbook
• SOC 2 Type I gap assessment (target window: Q4 2026)
• Bug bounty program (private launch on HackerOne planned)
• Database-backed audit log for security-relevant events (auth, billing, certificate issuance, finding accept/dismiss)

Not yet

• SOC 2 Type II — planned post Type I (~12 months after Type I kickoff)
• ISO 27001 — planned when EU customers require it; ~80% of controls overlap with SOC 2
• HIPAA — Business Associate Agreement available on request
• Third-party penetration test — annual, scheduled to coincide with SOC 2 audit window
• FedRAMP / StateRAMP / CMMC — not currently pursued (wrong fit for our customer base today)

About the LockUp Trust Report

The LockUp Trust Report is our automated external assessment of a scanned site. It is informed by ISO/IEC 27001 Annex A, the NIST Cybersecurity Framework 2.0, and the OWASP Top 10. It is not a third-party-audited ISO 27001 certification, which can only be issued by a certification body accredited under ISO/IEC 17021-1. The Trust Report is useful as a posture snapshot and as a pre-audit baseline — not as a substitute for formal certification.

Reporting a Vulnerability

We welcome reports from security researchers. Please email us at:

security@lockupscan.dev · powellb.elev8ai@gmail.com

We aim to acknowledge new reports within 24 hours and to provide a meaningful update within 5 business days. Full scope, safe harbour, and acknowledgments policy at /.well-known/security.txt.

Contact

Elev8 AI Solutions & Services
powellb.elev8ai@gmail.com
elev8ai.org