Trust & Security
How we think about security
LochStudios is operated by MURDOCH, LACHLAN ALEX as an individual sole trader, supported by a small team across production, support, and security. We take that seriously: a lean operation keeps our attack surface manageable, and we build processes so issues are caught and handled reliably. Everything below is something we run today — not a roadmap, not aspirational.
Where your data lives
Production services run in Australian data centres. Encrypted platform database backups are stored off-site in Cloudflare R2 object storage; payloads are encrypted before upload and Cloudflare is listed in our Privacy Policy data-processor register. cPanel hosting plan backups are taken by Acronis and stored on separate external infrastructure.
Some customer data is processed outside Australia where a sub-processor requires it — each listed in our Privacy Policy data-processor register (including Cloudflare for encrypted backup storage, Stripe for card processing, Twilio for SMS, and Microsoft for M365 mailboxes).
Encryption
All traffic to LochStudios is carried over HTTPS with HTTP Strict Transport Security (HSTS) preloading. Our web servers negotiate TLS 1.2 and TLS 1.3 — the protocol that encrypts data in transit. That is configured on our servers and is separate from the TLS certificate, which identifies the site. Public-facing certificates are issued by Let’s Encrypt and renewed automatically before expiry (authority and signature details are in our Privacy Policy).
Passwords are stored as Argon2id hashes. Two-factor authentication is TOTP, with optional WebAuthn for administrator accounts. TOTP secrets are encrypted at rest with the application key. SSL private keys you upload to the Panel are encrypted at rest and never logged in plaintext. Database backups are encrypted off-site with age X25519 public-key encryption; the private key lives in cold storage on hardware that is not internet-connected.
Authentication and access
Two-factor authentication is offered to every customer and is mandatory for any account with admin or staff role. Recovery codes are single-use and revoked the moment they are used. Admin sessions are short-lived; "remember this device" trust expires after 30 days.
Significant actions taken through the Panel — by you on your account or by our staff — are recorded in an append-only audit log. Each entry captures the actor, action, target, IP address, and user agent; where a change applies to a stored record, before and after snapshots of the affected fields are included. When an administrator acts through a client impersonation session, the impersonating administrator is recorded separately.
Operational security
SSH is disabled by default on all production servers. Only senior executives may access production hosts, and only via key-based SSH from a single whitelisted IP address. Software dependencies are tracked through Composer and reviewed for advisories on a weekly cadence; security-relevant updates are applied within 7 days of disclosure. Application errors are routed to an internal dashboard with severity-based alerting; critical errors alert the team immediately.
Incident response
If we discover a security incident affecting customer data, we notify affected customers as soon as we have a credible picture of impact — typically within 72 hours, faster where the situation allows. Notifications are sent to the email on file plus posted to the status page. Where the incident triggers Australian notifiable-data-breach requirements, we also notify the Office of the Australian Information Commissioner within the statutory window.
Responsible disclosure
If you discover a security vulnerability in a LochStudios service, report it to security@lochstudios.com with sufficient detail for us to reproduce and assess the issue. We will acknowledge receipt within one business day.
We welcome reports from security researchers acting in good faith. LochStudios will not initiate legal action against a researcher who reports a vulnerability responsibly, provided the researcher does not access, modify, or delete data belonging to other customers; does not degrade the availability of our services; gives us a reasonable opportunity to investigate and remediate before any public disclosure; and does not exploit the vulnerability beyond what is necessary to demonstrate it. With your consent, we may acknowledge you publicly once the issue is resolved; you may instead request that your identity not be disclosed. LochStudios does not operate a paid bug-bounty programme.
Compliance
We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and with the Spam Act 2003 (Cth) for any electronic messaging we send on a customer's behalf. Card processing is delegated entirely to Stripe; we are out of PCI-DSS scope as a SAQ-A merchant.
Contact
Security questions, vulnerability reports, or compliance enquiries: security@lochstudios.com.