Lightfield Trust Center

generated: '2026-08-13'
method: searched
probe: true
url: https://trust.lightfield.app/
source: https://docs.lightfield.app/security/
checked: '2026-08-13'
certifications:
- name: SOC 2 Type 2
  status: audited
  evidence: >-
    "Lightfield undergoes System and Organization Controls (SOC) 2 Type 2 audits of the design and
    operational effectiveness of our security and availability controls."
  source: https://docs.lightfield.app/security/
  report_access: Request a copy of the latest SOC 2 report from the Trust Center.
- name: HIPAA
  status: baa-available
  evidence: >-
    "Customers who need to store protected health information (PHI) in Lightfield may request a
    Business Associate Agreement (BAA). Under a BAA, Lightfield commits to compliance with HIPAA
    requirements for business associates that store and process PHI."
  source: https://docs.lightfield.app/security/
  contact: support@lightfield.app
- name: GDPR
  status: compliant
  evidence: >-
    "Lightfield is compliant with the EU General Data Protection Regulation (GDPR). We act as a data
    processor for the personal data our customers store in Lightfield." A DPA incorporating the
    Standard Contractual Clauses is available on request. Corroborated by the pricing page's
    security band, which lists GDPR alongside SOC 2 Type II and HIPAA.
  source: https://docs.lightfield.app/security/
  corroborated_by: https://lightfield.app/pricing
  contact: support@lightfield.app
- name: ISO 27001
  status: planned
  evidence: >-
    The pricing page security band lists "ISO 27001" with an explicit "Soon" badge alongside the
    three certifications Lightfield already holds. This is a stated intent, NOT a held
    certification, and is recorded as planned rather than audited.
  source: https://lightfield.app/pricing
  checked: '2026-08-13'
contacts:
  compliance: support@lightfield.app
  security: security@lightfield.app
evidence:
- source: https://docs.lightfield.app/security/
  kind: security-and-compliance-page
  confirmed: [SOC 2 Type 2, HIPAA, GDPR]
- source: https://lightfield.app/pricing
  kind: marketing-security-band
  status: 200
  checked: '2026-08-13'
  confirmed: [SOC 2 Type II, HIPAA, GDPR]
  planned: [ISO 27001]
  note: >-
    The pricing page renders a "Built for trust" band reading "SOC 2 Type II · HIPAA · GDPR · ISO
    27001 Soon", plus "Encrypted in transit and at rest, with role-based access and MFA". This is
    the human-readable source that resolves the 2026-07-19 ISO 27001 ambiguity: the string is real,
    but it is marked Soon, so ISO 27001 is recorded as planned, not held.
- source: https://trust.lightfield.app/
  kind: trust-center
  status: 200
  note: >-
    The Trust Center is a client-rendered single-page app; its certification list still cannot be
    read from the served HTML. Certifications above are taken from the docs security page and the
    pricing security band instead.
unverified_candidates: []
access_controls:
  encryption_in_transit: true
  encryption_at_rest: true
  rbac: true
  mfa: true
  sso: true
  sso_note: SSO and role-based access control are Enterprise-plan features (plans/lightfield-plans-pricing.yml).
  source: https://lightfield.app/pricing