Security-first by design, audit-ready by default
LobbyID handles sensitive people data — who is on site, vendor credentials, and in some cases biometric references. This page documents the controls, retention practices, and sub-processors behind that trust, so your security and legal teams can vet us before signing.
Encryption & transit
All data is encrypted in transit (TLS 1.2+) and at rest by our hosting provider. Database access is gated behind authenticated, role-scoped tokens — no anonymous reads.
Role-based access control
Every record is scoped by organization and role (admin, site admin, officer, tenant, vendor) with row-level security. Users only see their own organization's data — cross-tenant isolation is enforced at the database query level.
Comprehensive audit trail
Check-ins, door buzzes, credential changes, and incidents are logged with actor, timestamp, and context — exportable for insurance and legal review.
Biometric privacy
- Biometric enrollment requires explicit, signed employee consent captured on a recorded agreement.
- Strict-biometric states (IL, TX, WA, CO-class) are gated until a documented retention policy AND counsel sign-off are recorded.
- LobbyID stores only an enrollment reference — raw biometric templates live in your external vault or on-device, never in LobbyID.
- A documented retention and revocation-destruction policy is required before enrollment is unlocked.
Data retention
Retention windows are configurable per organization and per site from your admin settings.
Sub-processors
Incident response & breach notification
Suspected security incidents are triaged promptly by our team. In the event of a confirmed breach of personal data, affected customers are notified without undue delay in line with applicable law (e.g. GDPR Art. 33 / state breach-notification statutes), along with a remediation summary. A Data Processing Addendum (DPA) is available to enterprise customers on request. SOC 2 Type II certification is on our roadmap; until then, security questionnaires are welcome and we will provide documentation of our current controls.
Need a DPA or a security review?
Our team will route your security questionnaire and provide documentation of our current controls.