Security at Locus Founder

Locus Founder runs entirely on AWS inside an isolated, private network. Data is encrypted in transit (TLS 1.2 and above) and at rest (AES-256), each customer's workspace is logically isolated from every other, and the third-party credentials we hold on your behalf are encrypted a second time at the application layer. We are currently completing a SOC 2 Type II audit.

Our approach

Locus Founder is an AI agent that launches and operates internet businesses on your behalf. To do that, we hold credentials, customer data, and operating context that you trust us to protect. We design the platform so that security is enforced by the architecture: isolated environments, least-privilege access, encryption by default, and reviewed, automated deployments, rather than by manual process alone.

How is the infrastructure isolated?

Locus Founder is hosted entirely on AWS in the United States. Production and staging are fully separate stacks — separate VPCs, databases, caches, identity pools, and secrets — and application services run as containers in private subnets with no public IP addresses. The database and cache are never reachable from the public internet, and all infrastructure is defined as code and deployed through a reviewed, automated pipeline.

How is data encrypted?

Every connection is served over HTTPS with TLS 1.2 or higher. At rest, the database (Amazon RDS for PostgreSQL) and object storage (Amazon S3) use AES-256 with keys in AWS KMS. Third-party credentials — the OAuth tokens and API keys you connect — are encrypted a second time at the application layer (AES-256-GCM) before they touch the database, with keys managed separately from the data.

How are customers isolated from each other?

Locus Founder uses a strict one-account, one-workspace model. Every record is scoped to a workspace in both the database and the API, and the workspace identity in your session token gates all reads and writes. Engineers have no standing access to production data; operator access is brokered through AWS Systems Manager and recorded in CloudTrail — there are no shared SSH keys or public bastion hosts.

Where is the SOC 2 audit?

Locus is undergoing a SOC 2 Type II audit by an independent third-party auditor. As of June 2026 the audit is in progress and certification has not yet been obtained; the report will be available to qualified customers under NDA on completion.

Reporting a vulnerability

Found a vulnerability? Email security@paywithlocus.com. We operate a coordinated-disclosure policy with safe harbor for good-faith research, published in machine-readable form at /.well-known/security.txt.