Security

Your boards hold your plans, your clients' requests and sometimes your code's next move. Here is how Laneway protects them.

Every workspace is walled off

• Every query the service runs is scoped to one workspace, enforced in the data layer rather than left to each screen. Automated tests check every route: asking for another workspace's project, card or file returns "not found".
• Client embeds and portals only ever see whitelisted fields of cards that were deliberately shared, and only the requests of the person who is signed in.

Sign-in without passwords

• You sign in with a 6-digit code to your email or WhatsApp. There is no password to leak or reuse.
• Codes are stored as hashes, expire in minutes, and are void after five wrong tries. Requests are rate-limited per address and per network, with optional bot protection.
• You can see every device signed in to your account and end any session. A new device triggers an email.
• Our own staff use separate accounts, an optional authenticator app and an IP allowlist. Support can view a workspace only in a support session the workspace can see, and every action they take is logged.

Tokens and Claude Code

• API tokens for Claude Code and the laneway CLI are shown once, stored only as hashes, limited to the projects you choose and can be revoked at any time. They can't publish to portals, change billing or mark work done.
• In the web app, your session token lives in an httpOnly cookie the page's scripts can't read.

Files

Files are stored in private, encrypted object storage. Uploads are checked for size, type and real content type; downloads use short-lived signed links and require access to the card.

Data and secrets

• Connections are encrypted with TLS. Provider keys and webhook URLs are encrypted at rest and never shown again after you save them.
• Text from clients, portals, embeds and AI is treated as data, never as instructions, and rich text is sanitised before it is shown.
• The database is backed up every night. Daily copies are kept for 30 days and monthly copies for a year, encrypted, and used only to restore the service.

Audit trail

Workspace changes, staff actions and settings changes are written to an audit log, kept for 30 days to 1 year depending on your plan.

Reporting a vulnerability

If you think you've found a security issue, please email support@lanewayapp.com with "Security" in the subject and the steps to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll acknowledge your report within two working days, keep you updated, and credit you if you'd like once it's fixed.

See also our Privacy Policy.