Security

Lane is built for confidential financial work. We apply layered safeguards across identity, access, application delivery, integration credentials, and auditability, while keeping people responsible for reviewing and approving the work.

Rwk Group Holding AB, Swedish company registration number 559544-6450, with registered address Törnrosvägen 74A, 181 61 Lidingö, Sweden, operates the Lane Labs service ("Lane"). This page is a current overview, not a certification or a substitute for the security terms in an executed customer agreement.

Identity and access

• Lane validates active sessions and authorisation on the server rather than relying only on information held in the browser.
• Workspace roles and project membership checks scope access to product resources.
• Users can configure TOTP-based two-step verification, one-time backup codes, and revoke active sessions. Two-step verification is not currently mandatory for every user or sign-in path.
• Cookie-authenticated write requests use CSRF protection. Production sessions use secure, HTTP-only cookies.

Data and application protection

• Browser and API traffic is served over HTTPS. The application also configures transport, content-security, framing, referrer, and browser-permission headers.
• Stored connector credentials are envelope-encrypted with AES-256-GCM using a unique data key for each stored secret.
• File access is provided through time-limited signed links where supported.
• Production request controls include origin allowlists, CSRF checks, request validation, and rate limiting.

Lane uses shared cloud infrastructure with logical customer and project scoping. It does not represent that each customer receives physically dedicated infrastructure by default.

Auditability and secure delivery

Selected security and compliance events are written to an append-only, hash-chained audit log designed to make modification detectable. This mechanism applies to the events recorded through that audit path; it is not a claim that every product action is recorded or that a database owner cannot alter the system.

The product includes controls for dependency and secret checks, structured security logging, prompt-injection egress checks, and streamed output redaction for recognised secret patterns. These controls reduce risk but do not make AI-generated work or software systems error-free.

AI and connected services

Lane uses commercial AI APIs and other service providers to deliver enabled features. Depending on the feature, those providers may process prompts, selected project context, document excerpts, search queries, tool results, or document images. Lane does not describe these flows as zero-retention unless the applicable provider configuration and customer terms support that statement.

Connector access is limited to the scopes and features configured for the customer. Some integrations read content when requested; organisation-level indexing features may copy selected content into Lane for extraction, search, and analysis. Current providers and feature dependencies are listed in the Sub-processor Notice.

Hosting, retention, and deletion

Lane currently uses cloud services for the product interface, API, database, storage, email delivery, AI processing, and supporting operations. Processing is not represented as EU-only: some service providers may process data in the United States or other countries under the safeguards described in the applicable DPA and Sub-processor Notice.

Lane implements data export and scheduled account-erasure workflows, with failures surfaced for remediation. Specific retention, return, deletion, backup, and recovery commitments are governed by the executed customer agreement and its data-processing documents.

Assurance status

Lane is not currently ISO/IEC 27001 certified, and we do not present provider certifications as certifications of Lane or Rwk Group Holding AB. Any customer requirement for a particular assessment, control, service level, or deployment arrangement must be agreed in writing.

Report a security concern

Use our contact page to make initial contact. Do not include credentials, exploit payloads, customer content, or sensitive personal data in the form. Ask for a secure channel if sensitive detail is necessary.