Threat model

Every mitigation leaves something behind. This page names both halves, because a threat model that only lists defences is marketing.

An attacker reads the database directly

What protects you: Vault entries are encrypted in your browser under a key derived from your password. The database holds ciphertext and a wrapped data key.
What is still exposed: Unencrypted metadata (label, category, tags, schema type) is readable, along with consent terms and audit records.

A LucidData operator abuses privileged access

What protects you: The service role cannot decrypt vault contents, because no server-held key opens them. Row level security scopes ordinary access to the account owner.
What is still exposed: A privileged actor could read metadata and, today, could rewrite the audit table. External anchoring of the audit chain is not yet implemented.

Someone gets your password

What protects you: Second-factor authentication with an authenticator app, one-time backup codes, and passkeys are supported.
What is still exposed: A password plus a live session on an unlocked device gives full vault access. Idle locking and per-action re-authentication are limited today.

You lose your password and your recovery code

What protects you: A recovery code escrows a wrapped copy of your master key, and you can hold more than one recovery factor.
What is still exposed: If every factor is lost, the vault cannot be decrypted by anyone, including us. This is the cost of us not holding a key.

A recipient misuses data you shared

What protects you: Grants are time-bound, purpose-bound, revocable, and produce a signed receipt both parties keep.
What is still exposed: Revoking consent stops future access immediately. It cannot recall data that was already delivered. If you granted export access, the recipient holds a copy that no revocation can reach.

A fake organization contacts you

What protects you: Organizations must verify control of their domain through DNS before they can issue credentials, and verified status is shown on the verification page.
What is still exposed: Verified status proves domain control, not accreditation. It does not mean we vouch for the organization.

A subprocessor is breached

What protects you: Vault contents are ciphertext everywhere they are stored, so a storage breach does not yield plaintext.
What is still exposed: Metadata, consent terms, audit records, and billing details held by a subprocessor would be exposed.

Found something we missed

Report a suspected vulnerability to the address above. Tell us what you found and how to reproduce it. We will acknowledge within three working days. Do not access, modify, or exfiltrate other people accounts or data while testing.

security@luciddatabank.com