Security at
LotsTech

How we protect your data

• Our apps run on Cloudflare. Your data is stored in Supabase (Postgres) databases, primarily in the United States. The LotsStore store engine runs on a server we operate in Germany, behind Cloudflare.
• Every connection to our sites uses HTTPS, and our sites tell browsers to accept nothing else.
• Your data is encrypted at rest by our providers.
• You sign in to your LotsTech account with Google or a one-time code sent to your email, so there is no account password for us to lose.
• Your sign-in session is kept in a secure cookie that scripts on a web page cannot read.

Backups and recovery

• Every database is backed up every night. Backups are encrypted before they are stored, and kept separately from the live systems.
• A second copy of every database backup goes to a separate provider, where it is locked: nobody, including us, can change or delete it for 30 days.
• We keep a daily copy for 30 days and a monthly copy for about 13 months.
• The files you upload, such as images, videos and PDFs, are copied every night. If a file is overwritten or deleted, we keep the earlier copy for 30 days.
• We test our restores. Our first restore drill ran on 21 October 2026, and we run a restore test every week.

Monitoring

• Our apps report errors to our error monitoring, which alerts us when they happen.
• We monitor the uptime of our sites and APIs. Our status page is status.lotstech.com.
• Every morning, automated checks review our backups, signs of data loss, security warnings on our databases and servers, known vulnerabilities in the software we use, and certificate and domain expiry. We act on what they find the same day.

Access and payments

• Every product you share with a team has workspace roles. Each person sees and changes only what their role allows.
• We never see or store card numbers. LotsTech plans and credits are paid through Polar and Razorpay. LotsStore stores take payments through the seller’s own Razorpay or Stripe account.
• When a payment provider tells us about a payment, we verify the provider’s signature before we act on it.

Your data, your choice

• You can export your data. Many products let you do it yourself, for example contacts in LotsCRM, products and orders in LotsStore, and mailboxes in LotsMail. For anything else, email legal@lotstech.com and we'll send you a copy.
• You can delete your account. In LotsSocial and LotsLink you can request it from Settings, and for any product you can email legal@lotstech.com. We delete your account and data within 30 days and confirm by email.
• Copies in our encrypted backups expire on their normal schedule, within about 13 months. We never use them to bring back an account you deleted.

AI agents

• AI agents, such as Claude, ChatGPT or your own, connect to our products with OAuth or with an API key you create.
• An agent acts as you, with your role. It can do only what you can do in that workspace.
• You can see and disconnect connected apps at any time in Connected apps, and revoke API keys on the API page.

If something goes wrong

• We contain the problem, fix it, and tell the customers it affects. We tell them promptly, and within 72 hours where the law requires.
• After significant incidents we publish a short public write-up: what happened, what we fixed and what we changed so it does not happen again.

Report a vulnerability