Security

Last updated: 2 August 2026

LimeOrigin (operated by LimeLai Limited) is an AI-powered business platform: it builds and hosts customer websites, provisions business email, connects analytics and growth services, and takes payments. Security is designed into that stack rather than bolted on. This page describes the controls we operate and how to report a problem responsibly.

Data protection in transit and at rest

  • In transit: all traffic is served over HTTPS/TLS. The marketing site, the application and every hosted customer website are TLS-only.
  • Passwords: never stored in plaintext — hashed with scrypt. Session tokens and password-reset/verification tokens are stored only as hashes and are single-use with short expiry.
  • Connected-service credentials: OAuth refresh tokens and API keys (Google, Microsoft 365, Bing and others you connect) are encrypted at rest with AES-256-GCM using a dedicated credential-encryption key that is separate from session-signing keys and supports versioned rotation. Disconnecting a service deletes its credentials.
  • Fail-secure: in production the application refuses to encrypt credentials with a fallback key — a missing or weak key is surfaced by a health check rather than silently accepted.

Tenant isolation

  • Every organisation’s data is scoped to its own workspace. Database access is constrained by row-level security policies generated for each tenant table, and application queries are organisation-scoped on top of that.
  • Public customer websites are rate-limited per site so one site’s traffic cannot degrade another’s.
  • The marketing site, the authenticated application and hosted customer sites are served on cleanly separated hostnames.

Access control & accountability

  • Role-based access within each organisation — sensitive actions require an editor or owner role.
  • Optional two-factor authentication (TOTP) for accounts; the shared secret is stored encrypted.
  • An append-only audit log records sensitive actions, including actions taken by AI features, for security and support.
  • Sensitive endpoints are rate limited, and OAuth flows are protected against cross-site request forgery with signed, single-use state.

AI safety

AI features draft output for your review — they never publish on their own, and every AI action is recorded in your audit trail. Content sent to our AI providers is not permitted to be used to train their models under our agreements with them. See the Privacy Policy and Sub-processors for the providers involved.

Infrastructure & operations

  • Hosted on managed, reputable cloud infrastructure with encrypted, managed databases and automated backups.
  • Secrets are held in the platform’s secret store, never in source control, and are never written to logs, error telemetry or support bundles.
  • Changes ship through code review and an automated test suite (unit tests, schema-parity checks and tenant-isolation tests) before release.

Payments

Card payments are processed by Stripe, a PCI-DSS Level 1 service provider. Card details are entered directly with Stripe and are never stored on LimeOrigin’s systems.

Reporting a vulnerability — responsible disclosure

We welcome reports from security researchers and treat them as a priority. If you believe you have found a vulnerability:

  • Email security@limeorigin.com (or use the contact page) with enough detail to reproduce the issue — affected URL/endpoint, steps, and any proof-of-concept.
  • Give us a reasonable time to investigate and remediate before any public disclosure. We aim to acknowledge reports within 2 business days and to provide a remediation timeline after triage.
  • Please do not access, modify or delete data that isn’t yours, degrade the service (no denial-of-service or automated high-volume testing), or use social engineering, physical attacks or spam.
  • Test only against accounts and data you own. Stop and report if you encounter another organisation’s data.

Acting in good faith under this policy, we will not pursue or support legal action against you for your research. We do not currently run a paid bug-bounty programme, but we gratefully credit reporters (with your permission) on our acknowledgments page. Our machine -readable policy is published at /.well-known/security.txt.

Compliance

We operate under UK GDPR and the Data Protection Act 2018 as described in our Privacy Policy and GDPR statement. We are not yet independently certified to SOC 2 or ISO 27001; where we describe a control on this page, it is one we actually operate. We will update this page as our formal certifications progress.

Questions

Security questions and due-diligence requests: security@limeorigin.com. Data-protection questions: privacy@limeorigin.com.

Security · LimeOrigin