Security at Loran
Your account, data, and payments are protected by industry-standard security practices at every layer of our platform.
Password Security
All passwords are hashed with bcrypt before storage. We never store plaintext credentials. Password reset flows use short-lived signed tokens sent to your verified email.
Authentication & Sessions
We use JWT-based authentication with short expiry windows. Tokens are signed server-side and validated on every protected request. Role-based access control (RBAC) enforces permissions across client, designer, and admin roles.
Payment Security
Payments are processed exclusively through Paystack, a PCI-DSS compliant provider. Loran never stores card numbers, CVVs, or raw payment credentials. All transactions are verified server-side before order confirmation.
Data Encryption
All data in transit is encrypted via HTTPS/TLS 1.3. Sensitive fields in our database are encrypted at rest. We follow the principle of least privilege for all data access.
File & Media Uploads
Designer uploads and AI measurement photos are processed and stored via Cloudinary with signed URLs. User-uploaded files are validated for type and size before acceptance.
Incident Response
We maintain an internal incident response plan. In the event of a breach, affected users will be notified within 72 hours via email with instructions. We conduct regular internal security reviews.
Responsible Disclosure
Found a vulnerability? We appreciate responsible disclosure. Please send a detailed report to our security team. Do not publicly disclose the issue until we have had a chance to investigate and patch it. We aim to acknowledge all valid reports within 48 hours.
Report a Vulnerability