Security & data handling
Security & data handling
How logcat.ai handles access and your data. For compliance specifics (certifications, data residency, DPAs), email sales@logcat.ai.
Authentication
Several sign-in methods, all standard:
- Google OAuth and email/password for the console. Local passwords are stored hashed, never in plaintext.
- API keys for programmatic access. They’re generated per user, returned once, and stored only as a hash (the platform can’t recover your key, so treat the one-time value as a secret and rotate by revoking). Keys carry a fixed expiry.
- JWT session tokens for the web app, including WebSocket connections.
- Enterprise SSO over OIDC, with optional enforcement. See Teams, enterprise & SSO.
Access to the console and API is gated by these mechanisms.
Data at rest
- Uploaded files are stored in object storage and served over signed, expiring URLs, not public links.
- Credentials and keys are never held in plaintext. They’re stored hashed or in managed secret storage.
- All input is validated before it reaches the data layer.
Tenant isolation
Your uploads, and everything derived from them, stay scoped to your organization. Analysis produced for one organization is never reused for another.
Retention
An uploaded file stays in your workspace until you delete it. Deleting it removes it from your account, though the upload still counts against your storage allowance for the current period (the allowance refills on your reset date). For formal retention terms and deletion guarantees, email sales@logcat.ai.
Reporting a concern
If you believe you’ve found a security issue, email security@logcat.ai directly rather than filing it publicly. For anything about data handling specific to your organization, email sales@logcat.ai and we’ll walk through the details.