Security

Security, stated plainly.

We don't have a SOC 2 certificate to wave at you, so here's what we actually do — and what we don't claim.

What we do

• Authentication on non-public endpoints: API keys or admin tokens guard everything that isn't designed to be public.
• Encryption in transit: the service is deployed behind TLS (HTTPS) — we never recommend running it on plain HTTP in production.
• Input validation: every endpoint validates and size-limits its inputs; errors are structured, never stack traces.
• Structured logging: operational logs for reliability and incident response — no sensitive payloads in logs.
• Fail-closed configuration: if an auth secret isn't configured, protected endpoints refuse traffic rather than opening up.
• No secrets are hardcoded; all configuration is environment-driven.
• Deploy behind TLS (HTTPS) — the service sits behind nginx/Caddy or a load balancer in production.
• Project and waiver data is customer-confidential. Export everything (PDF/CSV) anytime; data is deleted on cancellation per the retention policy.
• API inputs are validated and size-limited; errors are structured JSON, never stack traces.

What we don't claim

• No SOC 2, ISO 27001, or other certifications — yet. We'll pursue them when customer demand justifies it, and say so here when we do.
• No security practice is a guarantee. We describe controls, not outcomes.

What the software does — and does not do

• Hashed keys: tenant API keys and e-sign signing tokens are stored only as SHA-256 hashes; a claimed key is shown exactly once.
• E-sign audit trail: every envelope records creation, viewing and signing events with timestamps, the signer's typed name, explicit consent text, and the SHA-256 hash of the exact document signed.
• Fail-closed billing: the Stripe webhook refuses traffic (503) until its signing secret is configured, and rejects unsigned or badly signed events (400).
• Legal boundary: LienLift provides templates and deadline information — not legal advice, and not a law firm. The software does not file or serve notices for you and cannot guarantee lien rights or payment; verify deadlines and statutory form language with a licensed construction attorney in the project state.

Report a vulnerability

Email don+lienlift@lifeofmorr.com with "security" in the subject. We'll acknowledge within 2 business days and keep you posted on the fix.