Security and Data Protection

API Security

HTTPS Encryption

All API requests and responses are encrypted using TLS 1.2+ (HTTPS). This ensures that data transmitted between your application and our servers cannot be intercepted or modified.

API Key Authentication

Every API request requires a valid API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Customer API keys are randomly generated, limited to the operations they are issued for, and stored only as a SHA-256 hash. Our team issues keys and can rotate or revoke a key at any time; email support@liendeadline.com to request a change.

Rate Limiting

Customer API keys and the hosted AI connector are rate-limited to prevent abuse and ensure fair usage.

What We Store

The public calculation endpoint and the hosted AI connector do not save the project facts you submit. Customer API activity is recorded only as key and account identifiers with the outcome, never the request body. Projects, customers and invoices that you add to your account, or import from QuickBooks or Procore, are stored so we can track their deadlines.

Request Logging

API requests are logged for security monitoring and debugging. Our logs include timestamps, endpoints, response codes and key or account identifiers, never the API key itself. Google Cloud also records each request's URL, client IP address and time. API logs are retained for 90 days.

Data Protection

Encrypted Database

All data is stored in PostgreSQL on Google Cloud SQL with encryption at rest. Our services connect with IAM database authentication, and each service's database role can reach only the data it needs; the website cannot read business data directly. Administrative database access is restricted to authorized personnel.

Password Security

User passwords are hashed with Argon2id before storage. We never store passwords in plain text and cannot retrieve your password if forgotten (password reset required).

Regular Backups

Automated daily backups with 30-day retention. Backups are encrypted and stored separately from production data. We can restore data to any point within the retention period.

Infrastructure Security

The website and API run on Google Cloud Run, with the database on Google Cloud SQL. This setup provides:

• Managed HTTPS certificates and Google's network-level DDoS protection
• Isolated, managed containers for each service
• Application secrets held in Google Secret Manager rather than in code
• Request logging through Google Cloud

Payment Security

Stripe PCI Compliance

All payments are processed through Stripe, which is PCI DSS Level 1 compliant (the highest level of payment security). We never see, store, or process your credit card information directly.

No Credit Card Storage

We do not store credit card numbers, CVV codes, or billing addresses. All payment data is handled securely by Stripe's infrastructure.

Compliance & Certifications

SOC 2 Compliance

We are working toward SOC 2 Type II certification. Our security practices align with SOC 2 requirements for security, availability, and confidentiality.

GDPR & CCPA Compliance

We comply with GDPR (EU) and CCPA (California) privacy regulations. Users can request access, deletion, or export of their data. See our Privacy Policy for details.

Report a Vulnerability

If you believe you have found a security vulnerability in LienDeadline, email support@liendeadline.com. Please include:

• The affected URL or component
• The impact you observed
• Steps to reproduce the issue

Please do not open public issues about vulnerabilities, and do not test against other users' data or accounts.

For the open-source agent tools, follow the security policy for the LienDeadline MCP server or the LienDeadline agent skills.