Security Overview
Data residency & encryption
• Customer log data is stored in AWS eu-west-2 (London): DynamoDB (recent, queryable records), S3 (archive/analytics), with per-plan retention.
• In transit: TLS 1.2+ on every ingestion endpoint and API.
• At rest: AES-256 server-side encryption on all data stores.
Access control
• Production access is limited to LogLens founders/operators; there is no offshore support team.
• Every service component runs under its own least-privilege IAM role; components can only reach the specific tables/buckets they need.
• Customer API keys are stored only as SHA-256 hashes — we cannot read your key back.
• OAuth tokens and third-party credentials are held in AWS Secrets Manager, encrypted with KMS.
• Ingestion is authenticated per-site (site-scoped keys or per-site drain secrets); one site's credentials cannot read or write another's data.
Tenant isolation
All log records are partitioned by website and organisation ID at the storage layer; every dashboard and API query is scoped server-side to the authenticated organisation. Aggregated public statistics (e.g. our crawler research) are anonymised counts that identify neither customers nor visitors.
Resilience & recovery
• Point-in-time recovery and deletion protection are enabled on primary data stores.
• Storage services are multi-AZ by design (AWS managed).
• Infrastructure activity is logged via AWS CloudTrail; application logs are retained ~30 days for operations.
Development & operations
• Changes ship through version control with review; deploy pipelines authenticate via short-lived OIDC credentials rather than stored cloud keys.
• Post-deploy health checks verify the service after each release.
• We monitor our own service with the same log-analysis and alerting the product provides (including probe/attack detection).
Breach response
We notify affected customers without undue delay — and in any event within 48 hours of becoming aware — of a personal-data breach affecting their data, with enough detail for the customer's own regulatory assessment (GDPR Arts. 33–34).
What we don't claim
We are not yet SOC 2 or ISO 27001 certified (on the roadmap). We do not run a public bug-bounty programme. We believe accurate documentation beats implied certification; the measures above are the ones we actually operate.