Latten

Security at Latten

Latten exists to show you what your AI costs and where your private data flows. That only works if connecting it never puts that data at more risk than it already is. So here is what we touch, what we could break, what a breach of us would expose, and what our downtime costs you — plainly. Every claim on this page is implemented today; nothing is aspirational except where we say so explicitly.

The fact sheet

Write access to your systems
None. Read-only database sessions, additionally forced read-only server-side.
In your request path
No. Observe-only at launch — our downtime cannot block or slow your systems.
Data we persist
Graph projections (actor and data-domain identifiers, findings) and crossing-event metadata. Never your rows, payloads, or PII values.
Credential storage
AES-256-GCM at rest; key held outside the database. Ingest tokens stored as SHA-256 hashes only.
Encryption in transit
TLS with certificate verification by default to every remote database; plaintext requires an explicit opt-out and never applies to public hosts silently.
SOC 2
Not yet certified. SOC 2 Type II preparation is actively underway — ask for our current status and timeline. We will never display a badge we don't hold.
Subprocessors
Fly.io (compute), Supabase (database), Mailgun (transactional email).

What Latten sees

Two feeds, both narrow by design.

  • The read-only connector. You hand Latten a read-only database connection you scope; Latten reads through it to build the authority graph. What we persist from that read is the projection — actor names, session identifiers, data-domain names, and the findings written about them — not the underlying records. Those identifiers can include people's names; we treat the projection as confidential customer data, and it is deleted on request and at termination.
  • Crossing events from the SDK. Each event is metadata: source, target, action, timing, model and token counts. Sensitive-data detection runs inside your process and reports types and counts only — the values never leave your infrastructure. Payload contents are not part of the event schema, so they cannot be sent by mistake.

Your data is never used to train models, and recommendation generation operates on finding metadata — kind, category, scope — never row values.

Our own blast radius

We measure blast radius for a living, so we'll state ours: the honest ceiling is whatever the connection you give us can read. We cap it twice, and ask you to cap it a third time.

  • No write path exists. Connector sessions are opened read-only and the server additionally forces default_transaction_read_only on every connection. Latten cannot mutate, delete, or lock your data.
  • Fixes never auto-apply. Every remediation is handed to your coding agent and lands as a diff you review. Latten has no deploy access, no shell access, and no agent of its own in your environment.
  • You choose the ceiling. Connect a least-privilege, read-only role — it's the same advice our product gives about every other standing access in your AI, and we hold ourselves to it first.

Assume we're breached

Zero trust applies to us too. Assume our database is stolen — here is the inventory, worst case first:

  • Exposed: graph projections (the identifiers above), crossing-event metadata, finding text, and operator email addresses. We say this plainly because you should weigh it — it is the full extent of what we hold about you.
  • Not usable: your database connection details (AES-256-GCM, key held in the runtime environment, not the database), ingest tokens (SHA-256 hashes only), and login sessions (hashed, 14-day expiry; login links expire in 15 minutes).
  • Your kill switch is yours: revoke the one database role you gave Latten and rotate the ingest key — both on your side, effective immediately, no dependence on us.
  • We notify promptly. If an incident touches your data, you hear it from us first, with the inventory of what was affected.

The audit trail itself is tamper-evident: enforcement events form a SHA-256 hash chain and database triggers reject updates and deletes, so even an attacker with database access cannot quietly rewrite history.

When Latten is down

Nothing happens to your systems. Latten is observe-only and sits outside your request path: no query, tool call, or answer waits on us. The SDK reports asynchronously from a bounded buffer and never blocks your code — if we're unreachable, it retries with backoff and, at worst, drops telemetry. The honest cost of a Latten outage is a gap in observation, never an interruption of your systems. We are early and do not yet publish an SLA; we'd rather tell you the failure mode than promise a number we haven't earned.

Defense in depth

No single layer above stands alone. Underneath them, independently:

  • Fail-closed inside Latten's own pipeline. If one of our checks can't run — redaction, attribution, access checks — the answer is withheld, not passed through.
  • Hardened connector. Outbound database connections resolve DNS once and pin the IP (no rebinding), block private, loopback, link-local, and cloud-metadata ranges in production, and verify TLS against the original hostname.
  • Tenant isolation. Every AI system is scoped to its operator; ingest tokens are per AI system; cross-tenant reads are excluded at the query layer and covered by regression tests.
  • Throttled by default. Ingest is rate-limited per AI system, login email is capped per address and globally, and login links expire in 15 minutes.

Compliance and privacy, honestly

  • SOC 2: we are not yet certified. SOC 2 Type II preparation is actively underway; ask us for the current status and target timeline. Until we hold a report, you will not see a badge here.
  • GDPR / CCPA: we act as a processor for the limited personal data described above (operator emails; actor identifiers in projections). A DPA is available on request, deletion requests are honored, and data is processed in the United States with the subprocessors listed in the fact sheet.
  • Questionnaires and review: we complete security questionnaires and will walk your team — or your AI reviewer — through the architecture and the code paths behind every claim on this page, under NDA.

Responsible disclosure

Found something? Tell us first: security@latten.io (machine-readable: /.well-known/security.txt ). We respond within one business day, we won't take legal action against good-faith research, and we credit reporters who want credit.