Security

This page summarizes how we protect the recordings and other data that customers put into Lighter Journeys. It describes the service as it runs today, and we update it when that changes. Our privacy page explains what we collect, why and for how long.

Hosting and location

Lighter Journeys runs on Microsoft Azure in the East US 2 region, in Virginia, United States. The web application, the analysis workers, the database, file storage and our server logs all run there. Sign-in and account management run on Clerk. Our subprocessors page lists every company that processes data for us, what it does and where.

We test changes in a separate staging environment, with its own database, file storage and sign-in.

Encryption

The website and its API accept only HTTPS, over TLS 1.2 or TLS 1.3, and redirect plain HTTP to HTTPS. Every response tells browsers to use only HTTPS with us (HTTP Strict Transport Security). File storage and the database accept only encrypted connections, with TLS 1.2 or later.

Azure encrypts every stored file, and the database and its backups, with 256-bit AES and keys that Microsoft manages.

Workspace isolation

Each customer's data lives in its own workspace, and every database record that belongs to a workspace carries that workspace's id. The application takes the workspace from the signed-in session, never from anything the browser sends. Customer requests use a database role that PostgreSQL row level security limits to the rows of that one workspace, so a mistake in a single query cannot read or change another workspace's data. Background analysis jobs and our staff tools use separate database roles that can work across workspaces, and customers cannot use them.

Automated tests check this isolation against a real PostgreSQL database. They run on pull requests and on every change to our main branch that touches code.

Recordings and share links

The app hands out recordings only through short-lived links that our server creates after it checks that the person asking may see that recording: a member of its workspace, someone holding a valid share link, or our support staff when the customer shares it on a support request (see below). A browser uploads a recording with a link that can write that one file and expires after 15 minutes. Playback uses a read-only link to one file that expires after 60 minutes. File storage allows no anonymous access.

A share link carries a random 256-bit token. It expires after 1, 7 or 30 days, as the person who makes it chooses, can be revoked at any time, and opens a read-only report.

Deleting a recording deletes its reports and share links straight away, and its files with follow-up checks that catch anything left behind.

Our staff's access

Lighter Journeys is run by its founder, the only person with administrator access to our Azure account and our code repository. Our support staff include an AI support assistant (Claude, made by Anthropic). It works only through our admin interface, never the pages customers use, with its own credential that is rate limited, and every use of it is logged and audited.

Support views a recording only when the customer shares it on a support request. The request then shows "Our team viewed your recording." Each viewing link lasts 15 minutes and every view is logged. Access ends when the customer withdraws it or the request closes, though a link already opened keeps working until it expires. Support staff watch a shared recording in the browser and do not download it.

Outside a support request, our founder views a recording only to investigate a report of abuse or a security incident, no more than needed to confirm the facts, and notes each view in the record of the investigation. The support assistant never does.

Backups and recovery

We can restore the database to any point in the last 7 days. Deleted or replaced files stay recoverable by us for 7 days in case of a mistake, then are gone for good. File storage keeps three copies of every file within one Azure data center in East US 2. We keep no copy in another region.

AI models

Transcription and analysis run on our own servers in our Azure account, using open-source models and models we trained ourselves. Any reading of text on the screen runs there too.

Outside AI models analyze customer recordings in one feature only, listening sentiment, and only for workspaces where we have turned it on. It sends narration audio, a short stretch at a time, with the matching transcript lines and a few calm clips of the same speaker, through OpenRouter to the models our subprocessors page names. It sends no video, and nothing from a recording uploaded before October 8, 2026. Every request asks OpenRouter to use only providers that do not collect the data and keep nothing after they answer.

The one other exception is our AI support assistant, which may view a recording only when the customer shares it on a support request. Using customer data for training is switched off for everyone; our privacy page explains each workspace's training setting.

Incidents

We follow a written procedure for security incidents and personal data breaches. We tell affected customers without undue delay.

Reporting a vulnerability

Send suspected vulnerabilities to chris@lighterjourneys.com. Please do not access, change or delete other people's data, and give us a reasonable time to fix the problem before you disclose it. Testing the security of the service needs our written permission first.

For your security review

Ask us for our security overview and data processing agreement. Write to chris@lighterjourneys.com.