Trust & security
We protect your business the way we tell you to protect it.
A company that sells security has to practise it. Here is how we handle your data and your accounts.
Access to your accounts
- We use our own named logins with limited roles in your accounts, never your passwords.
- We only ask for the access a job needs, and you can remove it at any time without asking us.
- Every LBX account with access to client systems uses multi-factor authentication.
- Logins and secrets are kept in a password manager, never in emails, chats or documents.
Your data
- We collect only what we need to do the work, and delete enquiry and outreach data after 12 months if no contract follows.
- Domains, accounts and files are registered in your name and stay yours.
- We never sell or share your data for marketing.
Our own systems
- Our websites are static: no admin panel, no database and no plugins to break into.
- Strict security headers (Content Security Policy, HSTS) and HTTPS everywhere.
- Email protected with SPF, DKIM and DMARC.
- AI tools help us monitor and report, but changes to client systems always need a person's approval.
Providers we use
| Cloudflare, Inc. | Website hosting, DNS, bot protection, privacy-first analytics |
|---|---|
| SEOHOST.pl | Email hosting (Poland) |
| Resend, Inc. | Delivery of website form emails |
| Stripe | Payments |
Found a security issue?
If you believe you have found a security vulnerability on an LBX Digital website, please email [email protected] with the details. Please give us reasonable time to fix it before sharing it publicly, and do not access or change data that isn't yours. Our security contact is also published in /.well-known/security.txt.