# Security Overview

> Source: https://docs.lorel.ai/en/specifications/security-overview/

This page explains how Lorel.ai encrypts data in transit and at rest, keeps AI features safe with guardrails, automatically masks sensitive information, and protects the platform as a whole.

## Overview

Lorel.ai protects your data by encrypting communication and the data stored in its databases and object storage.

For AI features, Lorel.ai applies guardrails as standard: a content filter that suppresses harmful content, and a filter that detects prompt injection (malicious instructions). Lorel.ai also automatically masks sensitive information such as credit card numbers and cloud credentials. However, the protection level for personal information is "Unprotected" by default. For details, see "3. Automatic masking of sensitive information."

These protections are built into the whole platform as standard, so they apply without any configuration on your side.

## Security features provided

The following table lists the security measures and defenses that Lorel.ai provides as standard.

| Area | Main measures | Configuration |
|---|---|---|
| Encryption in transit | Encrypts communication with web browsers and external services with TLS (1.2 or later). HTTP requests from browsers are automatically redirected to HTTPS, and HSTS (valid for about 1 year, including subdomains) is applied. | Applied automatically (no change needed) |
| Encryption at rest | Encrypts the data stored in the database and object storage at rest. | Applied automatically (no change needed) |
| Centralized AI calls | Routes calls from AI features through a common execution path inside the platform and applies guardrails. Lorel.ai monitors AI usage and guardrail activity. | Applied automatically (no change needed) |
| Content policy and guardrails | Applies a content filter for harmful content to AI input and output, and a prompt injection detection filter to AI input. | Applied automatically (you can't disable it) |
| Automatic masking of sensitive information | Detects sensitive information such as credit card numbers and cloud credentials, and automatically masks it in AI input and output. | Applied automatically (you can't disable it) |
| Access limits and rate limits | Limits access per IP address at the network boundary (WAF), and also inside the application for the main APIs. Applies stricter, dedicated limits to authentication APIs. | Applied automatically (no change needed) |
| Detection and blocking of malicious traffic | Blocks requests to the API that match known attack patterns, traffic from known malicious IP addresses, and requests typical of known automation tools. | Applied automatically (no change needed) |
| Browser security | Applies various security headers that work in the browser, such as clickjacking protection, to the web console as standard. | Applied automatically (no change needed) |

## 1. Encryption of communication and data

### Encryption in transit

- Communication from web browsers and integrated external services to Lorel.ai is encrypted with TLS (Transport Layer Security) 1.2 or later.
- HTTP requests from browsers are automatically redirected to HTTPS. Lorel.ai doesn't accept unencrypted HTTP access to the API.
- HTTP Strict Transport Security (HSTS) is enabled (valid for about 1 year, including subdomains) to make supporting browsers connect over HTTPS.

### Encryption at rest

- Data stored in the database and object storage is encrypted at rest.
- The platform manages the encryption automatically, so you don't need to manage keys or configure anything.

## 2. AI safety and guardrails

Lorel.ai applies layered safeguards to AI agent runs, designed for use in a business environment.

### Centralized management of AI calls

Instead of each feature connecting to a generative AI service on its own, calls from AI features go through a common execution path inside the platform, where guardrails are applied. Lorel.ai monitors AI usage and guardrail activity.

### Guardrails and content policy

- **Suppressing harmful content.** Lorel.ai applies a content filter for harmful content to the input to the AI (the instruction text and the data to analyze) and to the AI's output.
- **Protection against prompt injection.** In case malicious instructions are hidden in the instruction text sent to the AI, or in text that comes from incidents, telemetry, and tickets, Lorel.ai applies a prompt injection detection filter to that input. If the filter detects prompt injection, Lorel.ai stops processing that input.
- **Handling data retrieved from external tools.** Lorel.ai instructs the AI to treat data that it retrieves from external tools during an investigation as reference data, not as instructions. However, these measures don't fully prevent prompt injection.
- **Scope.** These guardrails apply automatically to AI agent runs, and you can't disable or relax them in your settings.

### Data processing regions

When Lorel.ai processes AI features (including the guardrail checks of input and output), the data may be processed in regions outside Japan within the Asia Pacific region.

## 3. Automatic masking of sensitive information

To reduce the risk of exposing sensitive information, Lorel.ai automatically masks it when data is passed to the AI and when the AI writes its response.

### Information that is masked

Sensitive information such as credit card numbers and cloud credentials is masked.

For personal information (addresses, email addresses, user names, and phone numbers), you can choose "Block," "Hide," or "Unprotected," separately for input and output. The setting applies per project for built-in agents and per agent for custom agents. The default is "Unprotected." For details, see [AI Agents Overview](/en/guides/ai-agents/).

### How it works

- **It detects sensitive information in both input and output.** Lorel.ai automatically detects the target information in the AI's output (analysis reports and comments) and in the input to the AI (such as the prompts that users enter and the incident content), and masks it. Lorel.ai also masks sensitive information in data that the AI retrieves from external tools. Detection is automated and doesn't cover every piece of information.
- **You can't turn off the masking of sensitive information.** It applies regardless of the project or role, and there is no setting on your side to turn it off.

## 4. Platform defense and access control

Lorel.ai uses multiple layers of defense to protect the system from unauthorized access and cyberattacks from outside.

### Layered access limits

- **Access limits.** Lorel.ai limits bursts of access from an IP address at the network boundary (WAF). For the main APIs, such as authentication and inbound events from external services, it also limits access inside the application.
- **Protection of authentication.** To help protect against brute-force attacks and credential stuffing, Lorel.ai applies stricter, dedicated limits to the login screen and authentication APIs than to regular APIs. If login attempts keep failing, the restrictions become gradually stricter.

### Detecting and blocking malicious requests and attacks

- **API defense.** Lorel.ai detects and blocks requests to the API that match known attack patterns.
- **Countermeasures against malicious IP addresses.** Lorel.ai automatically identifies and blocks traffic from known malicious IP addresses.
- **Countermeasures against automation tools.** Lorel.ai blocks requests that are typical of known automation tools.

### Browser security

When you access the web console, Lorel.ai sends various security headers to your browser, including headers that protect against clickjacking, to improve safety on the client device.

## 5. How the security features are applied

Lorel.ai designs its security features on the principle of secure by default.

- **Security features apply as standard.** Encryption of communication and stored data, AI guardrails, masking of sensitive information, and platform defenses apply to all customers in the same way. You can't disable them in your settings.
- **Lorel.ai doesn't provide settings that lower security.** To maintain security quality, Lorel.ai doesn't provide settings such as turning off encryption, disabling guardrails, or turning off masking of sensitive information. However, you can choose the protection level for personal information in the AI agent settings.

## Limitations

The filters and defenses rely on known patterns and automated detection. They can't guarantee detection or blocking of every attack or every piece of sensitive information.

## Related features

- [User Authentication](/en/getting-started/user-authentication/) (login authentication, password requirements, and how accounts are protected)
- [Roles and Permissions](/en/getting-started/roles-and-permissions/) (controlling access permissions for each participating user in organizations and projects)
- [Data Handling](/en/specifications/data-handling/) (automatic deletion when retention periods end, and how data is handled when a contract ends)
- [AI Agents Overview](/en/guides/ai-agents/) (AI agent settings and choosing the protection level for personal information)