Security Overview
License Logic is a SaaS platform for IT asset management, software license tracking, and employee usage analytics. We help organizations track software usage, manage contracts, detect shadow IT, and optimize spend.
Security is foundational to how we build and operate License Logic. We apply technical, organizational, and administrative safeguards to protect the confidentiality, integrity, and availability of customer data at every layer of our stack.
Our security principles:
Least-privilege access by default. Encrypt everything in transit and at rest. Never collect more data than needed. Read-only integrations wherever possible. Assume breach and design for containment.
Infrastructure & Hosting
Cloud Provider
License Logic runs entirely on Amazon Web Services (AWS). We do not operate our own datacenters. AWS maintains SOC 2 Type II, ISO 27001, SOC 1, and SOC 3 certifications for all facilities we use.
Architecture
| Component | Service | Details |
|---|---|---|
| Application | Vercel (Next.js) | Frontend and API routes with automatic HTTPS |
| Compute | AWS Lambda | Serverless functions for integrations and background processing |
| Database | AWS RDS (PostgreSQL) | Multi-AZ deployment with automated failover |
| Object Storage | AWS S3 | Encrypted at rest with SSE-S3/KMS |
| Caching | Upstash Redis, DynamoDB | In-memory caching and precomputed data |
| CDN | Vercel Edge Network | Global edge caching for static assets |
Network Security
- VPC isolation — Databases and internal services run in private subnets with no public internet access
- Security groups — Restrict inbound traffic to required ports only
- WAF — AWS WAF at API Gateway filters malicious requests
- DDoS protection — AWS Shield provides automatic DDoS mitigation
- Rate limiting — API Gateway enforces 50 requests/second per client
- VPC Flow Logs — Network traffic logged for monitoring and forensics
Monitoring
- CloudWatch — Infrastructure monitoring with anomaly detection and alerting
- Datadog — Application performance monitoring, browser RUM, and log aggregation
- Rollbar — Real-time error tracking and alerting
- AWS GuardDuty — Threat detection for AWS account activity
Encryption
Data in Transit
All data transmitted between clients and License Logic is encrypted using TLS 1.2 or higher. We enforce HTTPS on all endpoints. Plaintext HTTP connections are automatically redirected to HTTPS. Internal service-to-service communication also uses TLS.
Data at Rest
| Data Type | Encryption Method |
|---|---|
| Database (RDS PostgreSQL) | AWS RDS encryption (AES-256) |
| Object storage (S3) | SSE-S3 / SSE-KMS (AES-256) |
| OAuth tokens (Ramp, Entra, Okta, Google Workspace) | AES-256-GCM with per-token random IVs, application-level |
| Agent usage logs | AES-256-GCM with per-file key; RSA-2048 key exchange |
| Database backups | Encrypted via AWS RDS backup encryption |
Key Management
- Infrastructure keys (RDS, S3, EBS, Lambda env encryption at rest) are managed by AWS KMS with FIPS 140-2 validated HSMs — automatic rotation per AWS KMS policy
- Integration token encryption (OAuth tokens, API keys, client secrets for Entra, Okta, Google Workspace, Ramp, IntelAgree, Outlook) uses AES-256-GCM with a unique random initialization vector per record, derived from a master encryption key held in platform-managed encrypted environment variables (Vercel encrypted env secrets and AWS Lambda encrypted env vars)
- Desktop agent data (Mac/Windows agents) additionally uses a fresh AES-256 key and initialization vector per log file, each wrapped with RSA-2048 OAEP-SHA256 for transport — hybrid encryption scheme
- Master encryption key is rotatable — rotation procedure documented and practiced (last rotation: April 2026)
- Encryption keys are never committed to source control, never stored in the application database, and never transmitted in plaintext
Access Control & Authentication
Customer Authentication
Authentication is managed by Clerk, a dedicated identity provider. License Logic never stores customer passwords directly.
- Multi-factor authentication (MFA) available for all accounts
- SSO support — Microsoft Entra ID (SAML 2.0) for enterprise single sign-on
- Session management — Secure, httpOnly cookies with automatic expiration
- Password requirements — Enforced by Clerk with industry-standard hashing (bcrypt)
Role-Based Access Control (RBAC)
| Role | Capabilities |
|---|---|
Admin |
Full access: manage integrations, users, settings, contracts, and all data |
Manager |
Manage integrations and contracts; view all data; cannot manage users |
Viewer |
Read-only access to dashboards and reports |
Internal Access
- Employee access follows least-privilege principle — only granted what is needed for the role
- Production database access is restricted and audited
- Access is revoked immediately upon employment termination
- Access rights reviewed periodically and upon role changes
Audit Logging
All administrative actions are logged with audit trails including the user, action performed, and timestamp. Audit logs are stored in append-only storage with access controls to prevent tampering.
Data Handling & Privacy
Data Minimization
We collect only the data necessary to deliver our service. We do not collect, store, or process any of the following:
- Keystrokes or keyboard input
- Screen captures or screenshots
- File contents or documents (except uploaded contracts)
- Personal browsing history
- Audio, video, or camera data
- Personal communications (email body, chat messages)
Data Retention
| Data Type | Retention Period |
|---|---|
| Application usage logs | 12 months |
| Employee directory data | Synced daily; removed when employee is removed from directory |
| Transaction data (Ramp) | Retained while integration is active; deleted immediately on disconnect |
| Uploaded contracts | Retained until customer deletes or account is terminated |
| Customer data on termination | Deleted within 30 days of account termination |
Data Subject Rights
License Logic supports data subject rights under GDPR and CCPA:
- Access — Request a copy of your personal data
- Correction — Request correction of inaccurate data
- Deletion — Request deletion of your personal data
- Portability — Receive your data in standard formats (CSV, JSON)
- Export — Full data export available before account termination
Data Storage Location
All customer data is stored in AWS US regions. Specific region details are available upon request.
Third-Party Data Sharing
Customer data is never sold. Data is only shared with essential subprocessors required to deliver the service (see Subprocessors section). No data is shared for advertising, analytics, or any other purpose.
Endpoint Agents
License Logic offers optional desktop agents for macOS and Windows that collect application usage data for license optimization and shadow IT detection.
What Agents Collect
| Data | Purpose |
|---|---|
| Application process names and window titles | Identify which software is being used |
| Application usage duration | Measure actual utilization against license counts |
| Browser URLs (SaaS domains only) | Detect web-based SaaS usage for shadow IT discovery |
| User identity (email) | Associate usage with employee for per-user reporting |
What Agents Do NOT Collect
Privacy by design:
No keystrokes. No screen captures. No file contents. No personal browsing. No audio or video. No camera access. No location data. No personal communications.
Agent Security Architecture
- Least-privilege — Agents run without admin/root privileges
- Upload-only — Agents transmit data outbound only. No remote access, no command execution, no inbound connections
- Hybrid encryption — Each log file is encrypted with a fresh AES-256-GCM key. The AES key is then encrypted with RSA-2048 for key exchange
- TLS 1.2+ — All uploads use HTTPS. No plaintext transmission
- No persistent storage — Logs are encrypted and uploaded, then removed from the local device
Third-Party Integrations
License Logic integrates with third-party services using secure, standard protocols. All integrations follow the same security principles:
- Read-only access wherever possible — we never modify data in connected systems
- OAuth 2.0 for authorization — we never see or store your credentials for connected services
- Encrypted token storage — all OAuth tokens are encrypted with AES-256-GCM before database storage
- Revocable at any time — disconnect from License Logic or revoke access from the provider's side
- Scoped permissions — we request only the specific API scopes needed for each integration
Available Integrations
| Integration | Protocol | Access Level | Purpose |
|---|---|---|---|
| Microsoft Entra ID | OAuth 2.0 + Graph API | Read-only (scoped write available for licensed features) | Employee directory sync, SSO sign-in logs, app assignment, license inventory |
| Okta | API Token or OAuth 2.0 | Read-only | Employee directory sync, SSO app assignments, sign-in logs |
| Google Workspace | OAuth 2.0 + Admin SDK | Read-only | Employee directory sync, device inventory |
| Ramp | OAuth 2.0 | Read-only | Transaction and spend data sync |
Token Lifecycle
- Tokens are encrypted before storage and decrypted only at the moment of API calls
- Refresh tokens are automatically rotated when access tokens expire
- On disconnection, all tokens are permanently deleted from our database
- If a provider revokes access, License Logic detects the revocation on the next sync attempt and marks the integration as disconnected
Secure Development
Development Practices
- Code review — All changes require peer review before merging
- Input validation — Server-side validation on all user inputs and API parameters
- Output encoding — Contextual encoding to prevent cross-site scripting (XSS)
- Parameterized queries — ORM-based data access (Prisma) prevents SQL injection
- Dependency scanning — Automated scanning for known vulnerabilities in third-party packages
- OWASP Top 10 — Applications are designed and tested against the OWASP Top 10 vulnerability categories
Environment Separation
- Separate development, staging, and production environments
- Production credentials are never used in development or staging
- Infrastructure configuration is version-controlled
Change Management
- All code changes go through version control (Git) with full commit history
- Changes are tested in staging before production deployment
- Deployment pipelines enforce build and test checks
- Unauthorized changes are detectable through version control and deployment audit logs
Patching SLAs
| Severity | Response Time |
|---|---|
| Critical (CVSS 9.0+) | Patched within 24 hours |
| High (CVSS 7.0–8.9) | Patched within 7 days |
| Medium (CVSS 4.0–6.9) | Patched within 30 days |
| Low (CVSS 0.1–3.9) | Addressed in next release cycle |
Incident Response
Incident Response Plan
License Logic maintains a documented incident response plan covering:
- Detection — Automated monitoring, alerting, and anomaly detection
- Containment — Immediate isolation of affected systems
- Eradication — Root cause identification and remediation
- Recovery — Service restoration and verification
- Post-incident review — Lessons learned incorporated into procedures
Breach Notification
24-hour notification commitment.
If we determine that a security incident has resulted in unauthorized access to your data, we will notify affected customers within 24 hours of confirmation. Notifications include the nature of the incident, data affected, remediation steps taken, and recommended actions.
Security Contact
Report security incidents or concerns to security@licenselogic.co. This inbox is monitored continuously.
Business Continuity
Backups
- Frequency — Daily automated backups
- Retention — 30-day backup retention
- Encryption — All backups encrypted at rest
- Testing — Backup restoration validated periodically
Recovery Objectives
| Metric | Target |
|---|---|
| Recovery Time Objective (RTO) | 4 hours |
| Recovery Point Objective (RPO) | 24 hours |
Redundancy
Database infrastructure uses Multi-AZ deployment on AWS with automated failover. Application infrastructure is serverless (Lambda, Vercel) with built-in redundancy and automatic scaling.
Compliance & Certifications
| Certification | Status | Notes |
|---|---|---|
| SOC 2 Type I | Planned 2026 | In preparation; Vanta platform onboarded |
| SOC 2 Type II | Planned | Will follow Type I completion |
| Penetration Testing | Completed | Third-party penetration test completed March 2026 (ETH Security, OAuth integration scope). Full platform assessment planned for SOC 2 audit. |
| GDPR | Active | GDPR-ready data handling; DPA available |
| CCPA | Active | Compliant privacy notices and data subject rights |
| ISO 27001 | Not yet | AWS infrastructure is ISO 27001 certified |
| PCI DSS | N/A | We do not process payment card data |
| HIPAA | N/A | We do not process protected health information |
CAIQ available on request.
We maintain a pre-filled Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ v4.0) covering 99 controls across 17 domains. Contact security@licenselogic.co to request a copy.
Subprocessors
License Logic uses the following subprocessors to deliver our service. Customer data is shared only with these providers and only to the extent necessary for service delivery.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services | Cloud infrastructure (compute, database, storage) | All customer data | US |
| Clerk | Authentication and user management | User email, name, auth credentials | US |
| Vercel | Application hosting and CDN | Application requests (no data at rest) | Global edge |
| Upstash | Redis caching | Precomputed aggregates (no raw PII) | US |
| Google (Gemini API) | AI contract text extraction | Uploaded contract text (transient processing, not stored by Google) | US |
| OpenAI | AI contract text extraction (fallback) | Uploaded contract text (transient processing, not stored by OpenAI) | US |
| Anthropic | AI application categorization | Application names only (sanitized, no user PII) | US |
| Datadog | Application performance monitoring | Performance metrics only (no user PII) | US |
| Rollbar | Error tracking | Error context (no PII by design) | US |
| Crisp | In-app customer support chat | User browser context, support messages | EU (France) |
| Intercom | Public website chat | Anonymous visitor messages | US |
Customers are notified of material changes to this subprocessor list. All subprocessors are bound by data processing agreements with security and confidentiality obligations.
Vulnerability Disclosure
Reporting a Vulnerability
If you discover a security vulnerability in License Logic, we encourage responsible disclosure. Please report it to:
Email: security@licenselogic.co
Include a description of the vulnerability, steps to reproduce, and any supporting evidence (screenshots, logs, proof of concept). Please do not publicly disclose the vulnerability until we have had an opportunity to investigate and remediate.
Our Commitment
- Acknowledgment within 2 business days
- Initial assessment within 5 business days
- Remediation per our patching SLAs (critical: 24 hours, high: 7 days)
- Notification to the reporter when the issue is resolved
- We will not take legal action against researchers who report vulnerabilities in good faith
Scope
The following are in scope for vulnerability reports:
- License Logic web application (
app.licenselogic.co) - License Logic API endpoints
- License Logic desktop agents (macOS, Windows)
Organizational Security
Personnel
- Background checks performed for employees with access to customer data
- Confidentiality agreements (NDAs) required for all employees
- Security training included in onboarding and ongoing communications
- Access revocation is immediate upon employment termination
Security Governance
- Documented Security Policy, Privacy Policy, and Acceptable Use policies
- Ongoing risk assessments with vulnerability management program
- Executive oversight of security practices and priorities
Contact & Documentation
| Resource | Details |
|---|---|
| Security inquiries | security@licenselogic.co |
| General support | support@licenselogic.co |
| Privacy Policy | licenselogic.co/privacy |
| Data Processing Agreement | Available upon request |
| CAIQ Questionnaire | Available upon request |
| Security One Pager | Available upon request |
Need something specific?
If you have a vendor security questionnaire you'd like us to complete, or if you need documentation not listed above, please email security@licenselogic.co and we'll respond within 2 business days.