™US
Launch security and privacy posture for United States.
security
Built for guarded customer workflows.
lykbl is not claiming formal SOC 2 certification at launch. The app is designed to preserve the controls and evidence a future SOC 2 and GDPR review will expect.
Australia
Launch security and privacy posture for Australia.
EU
Launch security and privacy posture for European Union.
Launch controls
The US/Australia/EU launch baseline keeps sensitive actions server-side, validated, and reviewable.
- Strict security headers, framing protection, referrer policy, and permissions policy on the marketplace app.
- Customer actions are checked on the server before checkout, agent runs, publishing, or account changes.
- Private keys, payment credentials, social connection credentials, and provider credentials stay out of the browser.
- Credits are added only after Stripe confirms payment or a reviewed support record is complete.
- Protected app services accept requests only from trusted lykbl origins.
- Customer data is separated by account and workspace, with review history for payment, credit, agent, and publishing activity.
- Launch changes preserve least-privilege access and review history so future SOC 2 and GDPR work has evidence to inspect.
Payments stay hosted by Stripe
- Stripe-hosted Checkout Sessions, Stripe Payment Links, and Stripe-hosted billing portal flows are the allowed payment surfaces.
- Card details are handled by Stripe; lykbl does not collect, store, display, or proxy raw card data.
- Payment links use HTTPS and real Stripe-hosted payment pages.
- Checkout uses non-secret reference IDs and avoids putting buyer email in payment-link URLs.
- Payment help routes customers back to Stripe-hosted checkout instead of app-hosted card forms.
- Credits activate after Stripe confirms payment or a reviewed support record is complete.
Evidence kept for later review
- The launch posture is not a certification claim; it keeps evidence ready for qualified legal, security, and audit review.
- Deployment and test history is preserved for later review.
- Payment, credit, connection, agent-run, and publishing events keep durable review history.
- Operational changes are reviewed before write actions, and sensitive values are kept out of logs.
- Privacy requests should be tracked with request type, date received, customer identity, action taken, and completion date.
- Evidence should map to security, availability, processing integrity, confidentiality, and privacy without claiming certification.