Detection
Production runs structured request/response logging, per-tenant rate-limit metrics, AI usage logging, and an append-only audit log of every mutation and security event. Backend errors on both the API and the background worker flow to a centralised error tracker. The audit log is the forensic record we query during an investigation, not an automated detector: we do not run anomaly detection today, so a valid credential behaving abnormally is not flagged on its own. An investigation starts from an error signal or a report, and we treat any customer report of activity they did not perform as high-signal.
Containment
- Per-tenant kill switch. In a confirmed incident a Limena operator can freeze an affected workspace, disable its AI, and revoke all of its API keys at once. The freeze denies reads as well as writes and is enforced fail-closed; each action is audited.
- Session revocation. Sign-out-everywhere revokes every active refresh token for a user and writes an audit row. Access tokens are short-lived (15-minute) JWTs, so the worst case is a brief tail on an already-issued token; rotating the JWT signing key invalidates every session platform-wide at once.
- API key revocation. Tenant admins revoke API keys per key from Settings → API keys, and each revocation is audited. API keys are the likeliest exfiltration path because they are long-lived, so a suspect key is revoked first and investigated after.
- Mailbox disconnect. A connected mailbox implicated in an incident can be disconnected, dropping the stored OAuth tokens for that account.
- Credential rotation. JWT signing keys, the encryption master key, and third-party API tokens have documented rotation runbooks.
Communication
For confirmed security incidents affecting tenant data, Limena commits to:
- notification_window
- within 72 h of confirmation
- notified_via
- tenant owner’s email of record
- notification_includes
- scope · data affected · containment status · recommended actions · follow-up timeline
For incidents that do not affect tenant data (for instance an internal outage with no data exposure), we notify affected tenants directly where the impact was material and write a post-mortem, available from hello@limena.io on request.
How to reach us
Suspect an issue? Email hello@limena.io. See also the public /.well-known/security.txt for our RFC 9116 contact + reporting policy.