Security Overview

Last updated September 2, 2026

Contents

Product: LATO cloud agents platform · Vendor: Lato Tec Inc. (“LATO”) · Contact: security@latolabs.io

Architecture

LATO runs AI agents server-side on managed, certified infrastructure: backend on Railway (EU), Supabase Postgres, authentication and storage (EU) with row-level security, Anthropic Claude for inference, and one isolated Daytona sandbox per agent with outbound network restricted to an explicit host allowlist. LATO operates no datacenters of its own. Every subprocessor, with the data it receives and where it runs, is listed at /security/subprocessors.

Key controls

  • Tenant isolation at three layers. Database row-level security, application-level organization scoping, and a dedicated sandbox per agent.
  • Credentials never reach the model. Integration tokens live encrypted in Supabase Vault; sandboxes reach external APIs only through a proxy with short-lived scoped tokens.
  • No training on customer data. By design, and by contract with our AI providers.
  • Encryption everywhere. TLS 1.2+ in transit, AES-256 at rest, EU data residency for primary storage.
  • SSO-first access. Sign-in through Google, Microsoft, or your own SAML/OIDC identity provider (WorkOS), with MFA enforced at the identity provider; organization-level RBAC.
  • Every merge is gated. Mandatory code review plus blocking SAST, secret scanning, and dependency audits on a protected main branch; SBOM generated in CI.
  • Monitored and logged. Calibrated production alerting and append-only audit trails for authentication, application, and admin events.
  • Documented incident response. Severity-classified plan with a GDPR 72-hour notification procedure.
  • Tested recovery. BC/DR plan with an RPO of 5 minutes or less (point-in-time recovery) and an annual restore test, last passed June 2026.
  • AI-specific hardening. Untrusted email and Slack content is sanitized and boundary-marked so agents treat it as data, not instructions.

Vulnerability management

Remediation SLAs: critical 7 days, high 30, medium 90. Report issues to security@latolabs.io under our vulnerability disclosure policy, which covers scope, our commitments, and safe harbor for good-faith research; see also security.txt.

Certifications & documentation

GDPR: EU data residency, a GDPR Art. 28 DPA, and a public subprocessor list with 30 days notice of changes. A complete CSA CAIQ v4 self-assessment is available on request; SOC 2 and third-party penetration testing are planned, with no third-party audit to date. Security policies (information security, incident response, BC/DR, key management, data retention, code of conduct), the full CAIQ, and the DPA are available via security@latolabs.io, with questionnaire evidence shared under NDA.