Security is built into every layer of CreateLixir.
An overview of how we think about security, how we protect your data, and how we're building trust for the long term — written honestly, without overclaiming controls we haven't shipped.
This page is an overview — not a legal policy or a Trust Center
Security is a continuous discipline, not a checkbox.
Security is one of those things that stays quiet when it's working and becomes very loud when it isn't. We treat that asymmetry seriously — investing in the controls that make the quiet part reliable, rather than the ones that make the marketing loud.
We aim for long-term trust over short-term convenience. That means designing security into how features are built — not patched in after — and being straightforward about what's already shipped, what's on the roadmap, and what we don't do yet.
If a control appears on this page, we've built it. If a control is marked Planned, we intend to build it — but we won't pretend it's here until it is.
Encryption, isolation, and least privilege — by default.
The controls below are how your data stays yours. Each is either shipping today or clearly labelled as planned.
We prioritise a small number of high-leverage controls we can run reliably — encryption everywhere, workspace isolation, a dedicated secrets vault — over a longer list of practices we can't uniformly enforce.
- Encryption in transitShipped
All traffic between your browser and CreateLixir uses TLS. Nothing leaves your workspace or reaches our infrastructure in the clear.
- Encryption at restShipped
Data stored on our platform is encrypted at rest through our managed database and object-storage providers.
- Envelope-encrypted secretsShipped
Integration credentials and environment variables live in a dedicated vault behind AES-256-GCM envelope encryption, keyed per workspace.
- Workspace-scoped isolationShipped
Data is scoped to the workspace it was created in. Cross-workspace access requires an explicit action — nothing is shared by default.
- Responsible data handlingShipped
We retain only what CreateLixir needs to run the features you use. You can export what's yours; you can delete what's yours.
- Regional hostingPlanned
Choose the region your workspace lives in for teams that need geographic control over where their data is stored.
Your account, held to modern defaults.
Signing in, staying signed in, and — when the time comes — signing back in are all covered by the same discipline.
Authentication is handled by Better Auth with strong password hashing, OAuth via major identity providers, and session management scoped to your workspace. Two-factor authentication and enterprise SSO are on the roadmap.
- Secure sign-inShipped
Authentication is handled by Better Auth with modern password hashing, email verification, and hardened defaults.
- OAuth supportShipped
Sign in with your existing identity provider — no new password required. OAuth flows request only the permissions we need.
- Session managementShipped
Sessions are cookie-based, HTTP-only, and scoped to your workspace. You can review and end sessions from account settings.
- Account recoveryShipped
Standard email-based recovery with rate limiting and abuse protections.
- Two-factor authenticationPlanned
Time-based one-time passwords (TOTP) and hardware security keys for accounts that want the extra layer.
- SSO and SCIMPlanned
SAML SSO and SCIM provisioning for enterprise organisations. Shipping alongside Enterprise workspaces.
The controls behind the platform users see.
Security is a set of design decisions we live inside every day — not a phase-two initiative and not a compliance sticker.
- Shipped
Secure infrastructure
We build on managed cloud providers with proven security postures, and layer our own controls on top of theirs.
- Shipped
Continuous monitoring
Application logs, error tracking, and infrastructure observability are baseline — not a phase-two initiative.
- Shipped
Secure development practices
Code review, dependency scanning, and secret detection are part of every change we merge — not a quarterly sweep.
- Shipped
Responsible updates
Releases go out with clear release notes, versioned changelogs, and rollback paths. Nothing ships silently.
- Shipped
Access management
Every workspace has a clear set of members, roles, and permissions. Access can be revoked at any time from a single surface.
- Shipped
Risk reduction
We design for least privilege — every service, integration, and token has the narrowest scope that still lets it do its job.
- Shipped
Reliability
Availability is treated as a first-class product concern. We instrument the parts of the platform users depend on and invest ahead of pain.
- Planned
Independent audits
Third-party audits, penetration testing, and SOC 2 / ISO 27001 certifications are on the roadmap for Enterprise workspaces.
New capabilities come with new responsibilities.
AI-powered software creation touches sensitive project information constantly. The principles below are how we handle that responsibility.
The single most consequential AI-security decision we made is keeping secrets out of prompts. Our env-var vault exists specifically so the intelligence that reasons about your project never has access to the credentials that would let it affect production.
Beyond that, we treat AI behaviour the same way we treat any other privileged system: least privilege, retrieval-grounded reasoning, and meaningful human decision points in the loop.
- Protecting project informationShipped
Prompts, files, and generated code stay inside your workspace. We don't use your project data to train models — yours or ours.
- Respecting user privacyShipped
Only the data required to run a feature reaches the systems that need it. Anything beyond that stays put.
- Secrets isolated from promptsShipped
Env-var and integration credentials never enter AI prompts by design. The vault exists specifically to keep them out.
- Human oversightShipped
Meaningful decisions land on a human's screen with reasoning attached. AI takes the leverage; humans keep intent and control.
- Grounded reasoningShipped
The platform prefers retrieval-grounded responses over confident guessing. Every answer stays traceable to real project context.
- Model governancePlanned
Enterprise workspaces will be able to bring their own model providers under organisation-wide policy controls.
Security only works when both sides play their part.
We hold the platform to a high bar. There's a smaller set of things — mostly around your own account — that only you can do. The list below is what we ask of you.
None of these are surprising. What matters is treating them as real practices rather than posters on the wall — the way we try to treat the controls on our side.
- Use strong, unique passwords
A password manager makes this trivial. Reusing passwords across services is the single biggest account-security risk.
- Enable every security feature available to you
Two-factor authentication, session review, and integration audit — when they ship for your workspace, turn them on.
- Protect account credentials
Treat your CreateLixir login the same way you'd treat access to your codebase — because in practice, that's what it is.
- Keep recovery information current
An out-of-date recovery email is a locked-out account waiting to happen. Update it when you move providers or change devices.
- Review connected integrations
Every OAuth grant is a piece of trust you've extended. Periodically review which providers still need access, and revoke anything stale.
- Report anything suspicious
If something looks off — an unexpected email, a login you don't recognise, an unfamiliar workspace member — tell us. We'd rather investigate a false alarm than miss a real one.
Security is a moving target — we plan to keep moving.
The controls on this page are today's baseline. Two-factor authentication, SSO, SCIM, regional hosting, independent audits and industry certifications are all on the roadmap. We're building the underlying practices first so the certifications reflect what we actually do — not paperwork we ran through once.
As the platform grows, so does the surface we protect. We'll keep investing in stronger protections, more transparency, and third-party verification — and this page will grow with them.
Answers to the security questions people actually ask.
Data is encrypted in transit with TLS and at rest through our managed database and storage providers. Integration credentials live in an AES-256-GCM envelope-encrypted vault keyed per workspace. Everything is scoped to the workspace it belongs to, and cross-workspace access requires an explicit action.
Where else to look.
This page is the overview. For legal detail, use the policy. For live availability, use the status page. For a security concern, use the contact page.
Talk to us about security.
Directly.
Enterprise security review, responsible disclosure, or a question about a control on this page — get in touch and we'll route you to the right person.