Security

How Limitry handles your data, who can reach it, and how to report a problem. If your security team has a questionnaire, send it to security@limitry.com.

What Limitry stores

Your account and workspace details, your limits and every change to them, and usage counts per limit, per subject, per hour. A check carries a subject kind and id, an action name and a number. Limitry never sees the work behind a check: no prompts, model output or files. We ask you to send your own opaque ids (such as usr_123), not names or email addresses.

Where it runs

Limitry decides checks on Cloudflare's network. It stores accounts, limits and usage history in a managed PostgreSQL database (Neon) in a single region, with the provider's point-in-time recovery for backups.

Encryption

We encrypt all traffic in transit (TLS 1.2 or later, with HSTS), and the storage providers encrypt data at rest. We store only hashes of passwords, API keys and personal access tokens, and show a key or token only once, when created.

Signing in and access

People sign in with an email and password, checked against known breaches, and can turn on two-factor authentication. Inside a workspace, access depends on role: owners and admins change limits, and every member can see them. API keys carry scopes, so each service can have only the access it needs.

Our own staff must use a verified address and two-factor authentication to reach customer data, and we record every staff action on customer data.

Keeping workspaces apart

Limitry scopes every request to one workspace, and keeps each subject's counts separately per workspace. Tests that try to reach another workspace's data run on every release.

Webhooks

We sign every webhook delivery with its endpoint's own secret, shown once when you add the endpoint. Our SDKs check the signature and refuse deliveries more than five minutes old, so your endpoint can turn away a forged or replayed one.How to verify deliveries.

Audit log

Membership changes, limit changes, credits added, API keys and access tokens created or revoked, and webhook endpoints added go into an append-only log that workspace owners can read.

Sub-processors

Compliance

We haven't completed a third-party audit (such as SOC 2) yet. We can sign a data processing agreement on request. Ask us about our plans.

Reporting a vulnerability

Please report security issues privately to security@limitry.com, also listed at /.well-known/security.txt. Include what you found, where, and how to reproduce it. We reply within two business days, and ask for reasonable time to fix an issue before anyone makes it public.