Password protection
Passwords are hashed with bcrypt before they are stored. limewAI compares the hash during sign-in and does not need the original password.
Practical protection for the app-building journey.
Security is built into account access, project isolation, generated-code checks, preview infrastructure, credentials, and payment confirmation. This page describes controls that are present in the platform today.
Connection security
Encrypted traffic and protected infrastructure
limewAI’s public production entry point redirects web traffic to HTTPS and uses a TLS 1.2 and TLS 1.3 policy. Platform services run on cloud infrastructure, and the active deployment is operated in the AWS Europe (Stockholm) region.
Production databases are not publicly accessible. Database storage, runtime artifacts, and backup storage are encrypted with managed keys, while public access is blocked on the artifact and backup buckets.
Accounts
Passwords, sessions, and project access
Signed sessions
Signed access tokens identify the customer and session. Access tokens expire after 24 hours, refresh sessions are recorded, and signing out clears the browser session.
Project ownership checks
Customer project routes resolve a project together with its owner. A signed-in user cannot retrieve or change another user’s project through those routes.
Focused preview access
Preview links use a short-lived token tied to one customer and one preview session. That token is not accepted by the rest of the API.
Generated apps
Source is checked before it is allowed to run
limewAI validates generated projects before presenting them as working builds. The safety checks block exposed API keys, cloud credentials and private keys; executable javascript: links; unsafe client-side code execution; calls to localhost, cloud metadata endpoints and private network addresses; remote shell execution in package scripts; and packages outside the approved dependency policy.
The platform also checks that forms, API routes, and visible actions have usable contracts. These quality checks complement the core security rules; they do not replace normal security review for software handling sensitive or regulated data.
Preview isolation
Generated apps run away from the core application
Interactive previews run in separate managed runtime environments rather than inside the main limewAI web application. Preview access is scoped to the project session, and runtime traffic passes through a dedicated gateway.
Published applications are also managed as separate application machines. Platform secrets are not written into generated customer source, and generated apps are checked so they do not depend on limewAI’s internal platform API.
Secrets and providers
Credentials stay out of normal content
Infrastructure secrets are supplied through AWS Secrets Manager. Payment gateway credentials saved through the admin panel are encrypted with AES-256-GCM before database storage and are shown as saved or replaceable rather than displayed in full.
limewAI sends prompts and relevant project context to OpenAI when AI analysis, generation, correction, translation, verification, or image understanding is needed. Payment checkout is hosted by PAY2M. limewAI stores order, amount, status, callback, and transaction-reference records, but the checkout form sends payment details to PAY2M rather than collecting card details in limewAI.
Backups and logs
Recovery data is retained for defined periods
The production runtime database is configured with seven days of automated backup retention and a final snapshot on deletion. Runtime backup storage is encrypted, versioned, blocked from public access, moved to infrequent-access storage after 30 days, and removes non-current object versions after 90 days.
Platform application logs are configured for 14 days of retention. Logs are operational records and may contain request identifiers, job state, provider outcomes, and error details; secrets are not intended to be logged.
limewAI does not claim SOC 2, ISO 27001, PCI DSS, or another security certification on this page. The controls above are the controls confirmed in the current code and infrastructure configuration.