Skip to content
Security & trust

Security you can read without an NDA

We protect your data with encryption in transit and at rest, per-account isolation, and server-only secrets — and we publish exactly how, in plain language, right here. No gated portal, no signature required.

A
Independently rated

Rated A (100/100) by SecurityScorecard

A third-party, outside-in rating of our public security posture — not a self-assessment. As of June 2026. (A rating, not a certification; SOC 2 / ISO 27001 remain on our roadmap below.)

How we protect your data

Defense in depth, by default

The controls below are in effect today — not aspirations.

  • Encrypted in transit

    Every connection is served over HTTPS with TLS 1.3 through Cloudflare's global edge. Data moving between you and us is encrypted end to end.

  • Encrypted at rest

    Your data is stored in managed Postgres (Supabase) with AES-256 encryption at rest, so it stays protected on disk.

  • Row-level data isolation

    Row-Level Security is enabled on every table, deny-by-default. Where users have direct data access, owner-scoped policies tie each row to the account that owns it — verified in our migrations.

  • Secrets stay server-side

    API keys and database credentials live only in server-side code and never reach the browser. Privileged database access runs exclusively through a server credential that is never shipped to the client.

  • Abuse-resistant by design

    Public, cost-bearing endpoints are rate-limited per IP with sliding burst and sustained windows, so scripted hammering is throttled before it ever reaches our AI provider.

OWASP Top 10

Mapped to the most common web risks

Our own assessment of how Lova Plus addresses each risk in the OWASP Top 10 (2021). These are controls in effect today — it's a self-assessment, not a third-party certification.

  • A01 Broken Access Control

    Row-Level Security denies database access by default; users can reach only their own rows, and resource ownership is checked server-side on every request.

  • A02 Cryptographic Failures

    TLS 1.3 in transit (HSTS-enforced) and AES-256 at rest. Secrets and database credentials live only server-side and never reach the browser.

  • A03 Injection

    Database access runs through a parameterized query builder — no raw SQL — and all input is schema-validated before use. Generated HTML renders only in a sandboxed iframe.

  • A04 Insecure Design

    Public, cost-bearing endpoints are rate-limited per IP with burst and sustained windows, throttling abuse before it ever reaches our AI provider.

  • A05 Security Misconfiguration

    A strict Content-Security-Policy, HSTS, clickjacking and MIME-sniffing protections ship on every response, and we advertise no server version.

  • A06 Vulnerable & Outdated Components

    Dependencies are pinned to a committed lockfile and installed frozen in CI, and core frameworks (Next.js, React, Supabase) are kept on current major releases.

  • A07 Identification & Authentication Failures

    Authentication is handled by Supabase and re-verified server-side on every request, with rotating session tokens and enumeration-safe error messages.

  • A08 Software & Data Integrity Failures

    Deploys build from a frozen lockfile with pinned CI actions, and every release credential is stored as an encrypted CI secret — never in the repo.

  • A09 Security Logging & Monitoring Failures

    Server errors are captured in Sentry with route, method and status only — never headers, cookies, prompts, or query strings.

  • A10 Server-Side Request Forgery (SSRF)

    The app never fetches user-supplied URLs; every outbound call targets a fixed, hardcoded provider, leaving no SSRF surface to exploit.

Reference: OWASP Top 10.

Accessibility

WCAG 2.1 AA / Section 508

lova.dev and the Lova Plus platform are built and audited against WCAG 2.1 AA — the standard referenced by Section 508 — with accessibility remediation an ongoing part of how we ship. And it doesn't stop at our own sites: every website and app we build ships with an accessibility review against the same WCAG 2.1 AA / Section 508 standard, built into our launch and maintenance process.

Your data, your ownership

It's your work — and it stays yours

  • Export anytime, no lock-in

    You can export the code for the site you generate whenever you want and host it anywhere. We don't trap your project inside our platform.

  • We don't train AI on your content

    Your prompts are sent to our AI provider for the sole purpose of generating your site. Lova Plus never uses your content to train AI models, and we never sell your data.

Transparency

This page is public on purpose

Our security posture is documented here for anyone to read — no NDA, no sales call, no gated portal. We think you should be able to evaluate how we handle your data before you ever sign up.

Subprocessors

The vendors that help us run the service

We share data only with the providers below, each contractually bound to handle it securely and never use it for their own purposes. Your data is currently stored in the United States; EU residency is on the roadmap.

  • Cloudflare
    Hosting, global edge/CDN, DDoS protection, analyticsServes all traffic; processes IP and request metadata
  • Supabase
    Managed Postgres database & authenticationAccount and project data, encrypted with AES-256 at rest
  • OpenRouter
    AI model gatewayRoutes your prompts to a model provider to generate your site
  • Anthropic
    AI model provider (via OpenRouter)Processes prompts to produce output; not used to train models
  • fal.ai
    AI image & media generation for the builderImage-generation prompts for your site's visuals; no account or payment data
  • Stripe
    Payment processingBilling details and a tokenized card reference (we never store full card numbers)
  • Resend
    Transactional & product emailEmail address and the content of the emails we send
  • Sentry
    Error monitoringError diagnostics (route, status, short tags) — no prompts, emails, or secrets

Need a data processing agreement? Read our draft DPA (pending legal review). Building with the studio behind Lova Plus? See the Lova Studio security page.

On our roadmap

What we're working toward

These are in progress, not yet achieved. We'll update this page as each lands.

  • SOC 2 Type II & ISO 27001. We're actively pursuing SOC 2 Type II and ISO 27001 certification. We are not certified today and don't claim to be.

  • GDPR readiness. We're building toward GDPR readiness in parallel, including data export and erasure workflows.

  • EU data residency. Region pinning for customers who need their data stored in the EU is on the roadmap.

FAQ

Security FAQ

Not yet — SOC 2 Type II, ISO 27001, and GDPR readiness are on our roadmap and in progress, not yet achieved, and we don't claim to be certified. In effect today: TLS 1.3 in transit, AES-256 at rest, row-level data isolation, and server-only secrets.

Report a vulnerability

Found a security issue? We want to hear about it. Please disclose it responsibly and give us a reasonable window to investigate and fix it before any public disclosure. We don't take legal action against good-faith research.

Email our security team at securityplus@lova.dev. Our machine-readable policy lives at /.well-known/security.txt (RFC 9116).