# LAWDE Shield — Enterprise Compliance Pack
**Status:** Living document (not a certification attestation)
**Contact:** support@lawde.net
**Last updated:** August 2026
---
## 1. Security overview
LAWDE Shield is an AI-native error intelligence platform. Production crashes are ingested, scrubbed, clustered, and optionally diagnosed with AI — without retaining customer source code.
Core controls:
- **Edge scrubbing** strips common secrets, tokens, emails, and payment patterns before durable storage.
- **Workspace isolation** so one customer’s data is not readable by another.
- **Read-only GitHub Beacon** for blame/context; write access to customer repos is never requested for diagnosis.
- **Restricted-path protection** for `.lawdeignore` paths — no GitHub fetch and no AI grounding when a path is restricted.
- **Audit logs** (Business/Enterprise) for security-relevant workspace actions.
Authentication for Enterprise customers can use **SAML SSO**, with optional company-login enforcement for listed domains.
---
## 2. Zero-liability architecture summary
**Promise:** LAWDE Shield does not retain raw customer source code as a product artifact.
- Source snippets used for AI grounding are processed in-memory for the inference request.
- Variables holding source must fall out of scope after Athena / Aegis verification.
- Durable storage focuses on scrubbed error events, cluster signatures, metadata, and AI verdicts — not repository mirrors.
This is an architectural covenant enforced in product code and agent rules. It is **not** a substitute for your own legal review or a formal audit opinion.
---
## 3. Data Processing Agreement (DPA) template
This section is a **template outline** for Enterprise contracting. It is not executed until countersigned as part of an Order Form / MSA.
### Roles
- **Customer** = Controller (or Processor acting for its end users)
- **LAWDE** = Processor for error telemetry and related workspace data
### Scope of processing
- Categories: scrubbed error payloads, stack metadata, workspace membership, billing metadata, optional GitHub metadata (read-only), support communications
- Purpose: provide LAWDE Shield services (ingest, clustering, AI diagnostics, notifications, admin)
- Duration: term of the subscription + retention windows configured for the workspace
### Processor obligations (summary)
1. Process personal data only on documented instructions.
2. Ensure personnel confidentiality.
3. Implement appropriate technical and organizational measures.
4. Engage subprocessors only under written terms no less protective; maintain a current subprocessor list (below).
5. Assist with data subject requests where feasible given the nature of telemetry.
6. Delete or return personal data at end of service per retention settings / contract.
7. Make available information reasonably necessary to demonstrate compliance.
### International transfers
Transfers follow the mechanisms agreed in the executed DPA (e.g. SCCs where required). Hosting regions depend on the Customer’s Supabase / infrastructure configuration for the LAWDE deployment serving that tenant.
**To execute a DPA:** email support@lawde.net with your legal entity details.
---
## 4. Subprocessor list
| Subprocessor | Purpose | Data typically involved |
|---|---|---|
| Supabase (Postgres, Auth, Storage as configured) | Primary application database, authentication (incl. SAML ACS), platform APIs | Account, workspace, scrubbed errors, SSO identities |
| Vercel (or equivalent app host) | Application hosting / edge | Request logs, session cookies |
| OpenAI (or configured LLM provider) | Athena diagnostics (when enabled) | Scrubbed prompts / context — no intentional source retention |
| Resend / SMTP provider | Transactional email | Email addresses, notification content |
| Paystack | Subscription billing | Billing email, payment references (no full PAN stored by LAWDE) |
| Upstash (Redis) | Rate limiting / short-lived dedupe | Keys / counters, not source code |
Customers will be notified of material subprocessor changes per the executed agreement (target: 30 days where contractually required).
---
## 5. SOC 2 / HIPAA roadmap note
**Current state (honest):** LAWDE Shield is **not** SOC 2 Type II attested and **not** HIPAA certified as of this document.
**Roadmap:** SOC 2 / HIPAA compliance work is targeted for **Q4 2026** (same public commitment as the Enterprise SLA page). Until an independent report is issued:
- Do **not** treat this pack as an audit report.
- Do **not** claim LAWDE is “SOC 2 certified” in your own materials based solely on this document.
- Enterprise prospects should request the latest status from support@lawde.net.
---
## 6. Related public pages
- Enterprise SLA: /enterprise/sla
- System status: /status
- Security policy: /legal/security
- Privacy policy: /legal/privacy
- Responsible disclosure: /legal/disclosure
---
© 2026 LAWDE. Internal / customer diligence use.
