A security company should be the easiest vendor you ever assess
How the platform is built, where your data sits, who can touch it, what happens when something breaks, and how to tell us when you find something.
9F3C 41A2 7B5D 08E6 1C44 2D97 A05B 6E31 D8F0 7C29How we operate
Stated as commitments, not as badges. Each one is something a customer can ask us to evidence.
Read-only by default
Discovery and posture evaluation run on read-only roles. Write access is requested per action, is disabled by default, and every use is recorded in an audit log you can export.
Least privilege internally
Production access is time-boxed, requires a second approver and is logged. There is no standing administrative access to customer tenants.
Tenant isolation
Each tenant has its own logical namespace and its own encryption keys. Programme customers may supply their own key material.
Encryption
TLS 1.3 in transit. AES-256 at rest for findings, evidence and the change ledger, including backups and exports.
Change management
Every production change is reviewed, tested and released through the same pipeline. Emergency changes are retrospectively reviewed within two business days.
Vendor review
Sub-processors are assessed before onboarding and reviewed annually. The current list is published below and changes are announced 30 days in advance.
Where it sits and how long it stays
Residency is selected at tenant creation and cannot silently change. Evidence and findings never leave the region you chose, including backups.
- Regions available
- EU (Frankfurt), UK (London), US (Virginia), Canada (Montreal)
- Findings retention
- 36 months, configurable down to 12
- Evidence retention
- 12 months by default
- Deletion on exit
- Within 30 days of contract end, on written confirmation
- Secret materialWe model entitlements and lease telemetry. Secret values are never read or stored.
- Customer end-user dataDiscovery records that a data store exists and who can reach it — not what is inside it.
- Full packet captureReachability is derived from configuration, not from traffic inspection.
- Keystrokes or screen contentThe optional host agent reads process and network metadata only.
What happens when part of it breaks
Every region runs across at least three availability zones with automated failover.
Recovery point objective for findings, evidence and the change ledger.
Recovery time objective for the console and API in the primary region.
Restore tests, with the results written into the assurance pack.
| Provider role | Purpose | Regions |
|---|---|---|
| Primary cloud provider | Compute, storage and managed databases | EU, UK, US, Canada |
| Error monitoring | Application exception collection | EU |
| Email delivery | Transactional notifications | EU |
| Support desk | Ticketing for customer support | EU |
Live component status and incident history is published on the status page
Found something? Tell us directly.
Send it to security@lodemark.com, encrypted to the key above if you prefer. We will not threaten you, and we will not ask you to sign anything before we look at it.
Research conducted in good faith and within the scope below will not lead to legal action from us. If a third party takes action over research we invited, we will say publicly that it was authorised.
The production console and API, our public marketing site, and the connectors we publish. Denial-of-service testing, social engineering and physical testing are out of scope.
An acknowledgement within one business day, a triage decision within five, and a remediation plan with dates for anything we accept as valid.
Not as a public programme. Valid reports receive public credit if you want it, and we will say clearly when we cannot offer a reward.
Yes, with written notice to the security inbox so we do not treat your test as an incident. Tell us the window and the source addresses.
Need the full assurance pack?
Ask and we will send the current pack: scoring method, architecture summary, data-flow diagrams, restore test results and the accepted risk register.
Illustrative product data. Nothing on this site performs a live scan.