Security

How we protect your data

Lyng stores code, customer details, orders and sign-ins for you and your customers. This is how we look after them.

Encrypted in transit

All traffic uses HTTPS, with HSTS so browsers never use an unencrypted connection.
Certificates renew automatically, also for custom domains.
The connection between the app and the database is encrypted.

Encrypted at rest

Customer details in orders and database passwords are encrypted with AES-256-GCM and our own keys, on top of disk encryption.
Each encrypted value is bound to its record, so it cannot be moved to another.
Keys can be rotated without downtime.
The database and backups are encrypted by our hosting provider in the EU.

Every project on its own

Each project has its own schema and database user and cannot see other projects' data.
Code is built and run in isolated sandboxes, not on our servers.
Published sites are static files. Customer code never runs on the server.

Only what you open up

Every table has its own rules for who can read and add rows.
Personal data is closed to the site by default. You see it in Studio.
With sign-in, each user can be limited to their own rows.

Payments

Card payments are handled by Stripe (PCI DSS level 1). Card numbers never reach Lyng.
Price and stock are checked on our side for every purchase, so nobody can change the price in the browser.
Receipts need a secret link that only the buyer gets.

Sign-in

No passwords to leak: sign-in uses a one-time link or a one-time code by email.
Links work for 30 minutes, codes for 10 minutes and allow five attempts.
Sessions and codes are stored only as fingerprints (hashes), never in plain text.
Rate limits stop guessing and spam.

Safe code

Secret keys are stopped before they end up in the code or get published.
Sites imitating banks and authorities are stopped before publishing.
Security headers (CSP, HSTS and clickjacking protection) on Lyng and on published sites.
Visitors can report abuse from every published site.

Privacy

All data is stored in the EU, and we have a data processing agreement for businesses.
Deleting a project deletes its database, users and orders.
Users of your apps can delete their own account, and their data goes with it.
Fonts on the sites load from the site itself, not from Google.

Found a vulnerability?

Tell us before you share it with others, and we will fix it quickly..