Security

LotStudio AI holds two things worth protecting: your inventory photographs, and the accounts that reach them. This page describes the measures in place today. We would rather describe them accurately than impressively — where a control is planned rather than live, it is listed under Roadmap.

If you are completing a vendor security review, contact security@lotstudio.ai and we will work through your questionnaire directly.

Accounts are issued to named businesses and are invite-only. There is no open sign-up; a user cannot create an account without being invited.

Authentication is handled by Supabase, which supports email-and-password and single-use magic-link sign-in. We never see or store your password. Every application route other than the public marketing pages requires a valid session.

Tell us promptly when a member of your staff leaves so we can revoke their access.

All traffic to the application and the API is served over HTTPS with TLS. Transmission of photographs to our image-processing sub-processor is likewise encrypted in transit.

Photographs and job records are stored on infrastructure operated by Render in the US (Oregon) region, and account records in Supabase. We rely on those providers’ platform-level encryption and physical security controls; their current certifications are published on their own trust pages.

Files are served through the application rather than from a public bucket, so a request for a stored file requires an authenticated session.

The machine-to-machine endpoint authenticates with a secret key supplied in a request header, compared using a constant-time check so the comparison does not leak the key through timing. Keys are issued to you directly and are never exposed in the web application.

Treat your key as a credential: store it in a secrets manager or environment variable, never in client-side code or a public repository. Contact us to rotate a key at any time, and immediately if you believe one has been exposed.

When you upload an image it is stored, transmitted to our image-processing sub-processor to generate the replacement background, and the result is written back against your job along with a thumbnail and an audit file.

Your photographs are not used to train any model, are not shared with other customers, and are not used for any purpose other than producing your output.

You can delete any photograph — individually or by selecting several at once — from the dashboard. Deletion removes the original, the processed output, the thumbnail, and the audit file.

Every processed image carries audit metadata recording that the vehicle was not altered — no change to badges, emblems, model names, wheels, ride height, paint, trim, lighting units, or registration plates. This is a product guarantee as much as a security one, and it is why every job passes through a review step before it can be exported.

If you believe you have found a security issue, email security@lotstudio.ai with enough detail to reproduce it. We will acknowledge within 2 business days and keep you updated while we investigate.

Please give us a reasonable chance to fix an issue before disclosing it publicly, and do not access, modify, or delete data belonging to anyone else while investigating. We will not pursue action against researchers who act in good faith within those bounds.

If an incident affects your data we will notify you without undue delay and within the window set out in the Data Processing Addendum, describing what happened, what was affected, and what we are doing about it.

Controls we are working toward, listed here so you can judge the current state accurately rather than infer it:

• We do not currently hold SOC 2 or ISO 27001 certification, and we will not imply otherwise. We rely on the certifications of our infrastructure providers.
• We have not yet commissioned an independent penetration test.
• Single sign-on and role-based access for multi-rooftop groups.
• Customer-configurable retention periods.