Security is part of how we build and operate Localblend.
This page describes our general approach to protecting the Service and customer information.
It is intended to provide transparency about our security practices. It is not a guarantee that a security incident can never occur and does not create a service-level agreement.
1Our Approach
We aim to apply security controls appropriate to the size, nature and risk profile of the Service.
Our approach includes protecting data in transit, controlling access to production systems, securely managing credentials, maintaining software dependencies, monitoring important systems and preparing for security incidents.
Security controls evolve as the Service and the risks around it evolve.
2Encryption in Transit
Connections between supported web browsers and Localblend are protected using HTTPS/TLS.
We use encrypted connections with service providers where supported and appropriate.
3Data at Rest
Customer information is stored using reputable infrastructure and database providers.
Access tokens for Connected Services are encrypted before they are stored in our database.
4Passwords and Authentication
Where Localblend manages passwords directly, passwords are stored using one-way password hashing rather than as readable plaintext.
We use authentication controls intended to reduce unauthorised account access.
Two-factor authentication is available for customer accounts.
Customers are responsible for choosing secure credentials, protecting their devices and limiting account access to authorised users.
5Access to Production Information
Access to production systems and customer information is limited to people and systems that reasonably require it to operate, secure or support the Service.
We aim to follow least-privilege principles and to remove access when it is no longer required.
We do not access Customer Content simply out of curiosity.
Access may occur where reasonably necessary to:
- respond to a support request;
- investigate a technical problem;
- detect or investigate abuse;
- respond to a security incident;
- maintain the Service; or
- comply with a legal obligation.
When our staff sign in to a customer account to provide support, that access is recorded.
6Infrastructure
Localblend uses third-party infrastructure and software providers to operate the Service.
These may include providers for:
- application hosting;
- databases;
- object storage;
- email;
- payments;
- authentication;
- monitoring;
- analytics;
- artificial intelligence; and
- customer support.
Our Privacy Policy explains how personal information may be disclosed to service providers.
7Application Security
We use development practices intended to reduce common software-security risks.
Depending on the component, these may include:
- dependency management;
- framework security protections;
- code review;
- automated testing;
- access controls;
- secure handling of secrets;
- logging and monitoring;
- rate limiting;
- input validation; and
- security updates.
No software-development process eliminates every vulnerability.
8Secrets and Credentials
Application secrets, API credentials and infrastructure credentials should not be committed to public source-code repositories.
We use environment-specific secret-management mechanisms to separate sensitive credentials from application code.
Connected-platform access tokens are treated as sensitive credentials and access is restricted accordingly.
9Backups and Recovery
We maintain backups intended to assist with recovery from operational failures.
We do not promise that every individual item of data can be restored from backup.
10Monitoring and Logging
We may maintain system, application, authentication and security logs to help operate the Service, detect abuse, investigate incidents and diagnose faults.
Access to logs is restricted according to operational need.
Logs are retained only for as long as reasonably necessary for their purpose, subject to technical and legal requirements.
11Vulnerability Management
We monitor dependencies and infrastructure for relevant security updates and aim to address vulnerabilities according to their severity and practical risk.
Security issues that create material risk receive higher priority than low-risk findings.
12Security Incidents
Despite reasonable precautions, no online service can guarantee that security incidents will never occur.
If we become aware of an incident affecting customer information, we will investigate it, take reasonable steps to contain and remediate it, and make notifications where required by applicable law.
Where appropriate, we will communicate material incidents to affected customers.
13Data Breaches
Where the Notifiable Data Breaches scheme or another applicable breach-notification law applies to an incident, we will follow the applicable notification requirements.
We maintain an incident-response process appropriate to the Service.
14Customer Responsibilities
Security is shared.
Customers should:
- use unique, strong passwords;
- enable two-factor authentication;
- restrict accounts to authorised users;
- remove access when team members leave;
- secure devices used to access the Service;
- review permissions granted to Connected Services; and
- contact us promptly if they suspect unauthorised access.
15Third-Party Platforms
Integrations with third-party platforms depend partly on those providers' own security.
We do not control the security of Connected Services.
Customers should independently secure those accounts and review their access permissions.
16Reporting a Security Issue
If you believe you have found a security vulnerability in Localblend, please report it privately to:
Please include enough information for us to understand and reproduce the issue.
Do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate it.
Do not access, alter or download data belonging to other users beyond what is strictly necessary to demonstrate a vulnerability.
We will not pursue legal action against good-faith security researchers who act responsibly, avoid privacy violations and make a reasonable effort to comply with this process.
17Security Questions
For security-related questions, contact:
Localblend
[email protected]
localblend.io
Effective 10 October 2026.