Security & Trust
How Lina is secured — what we actually do.
If an AI is going to talk to people for you, you should know how it is kept safe. This page lists only what we really do today. How we handle personal information is in our Privacy Policy, Data Processing Addendum and Subprocessors list.
At a glance
The short version.
01 — Architecture & isolation
A multi-tenant service, isolated on every request.
Lina is multi-tenant: every organization runs on the same application and the same Postgres database, hosted on Railway in the United States in a Railway project of its own. What keeps organizations apart is enforced in code on every request, and tested.
- Each request is resolved to exactly one organization from the web address it arrives on, and every read and write goes to that organization’s own storage area.
- Sign-in sessions carry their organization and are refused on any other organization’s address.
- Credentials for inbound integrations (email, texts, notes sync) are issued per organization; a platform-wide secret never opens an organization’s space.
- The staff AI (MIND) runs as its own service, reached only through the organization’s own site, which tells it which organization is asking.
- Each phone number belongs to one organization. Calls are routed by the number dialed and refused when that organization’s plan or billing does not allow them.
- Automated tests drive two real organizations side by side through the real application to check that nothing crosses over.
02 — The AI safety floor
A few rules written into the platform’s code.
Each organization can edit its assistant’s prompts, knowledge and notes — so the rules that must always hold are not kept there. They are part of the platform code and head every conversation, above anything an organization adds:
- Before a call reaches the AI agent, and before any hold message the organization sets, the phone system itself plays a fixed notice, word for word: “You're speaking with an AI assistant. This call is transcribed to help us respond.” (plus “It may also be recorded.” when the organization records calls). Before voicemail records a message, it plays “You've reached an automated voicemail line. Your message will be recorded.” Every call the AI agent answers then opens with the agent’s own disclosure, which it is instructed to say word for word: “Just so you know, you're speaking with the organization's automated AI assistant, not a live person.”
- Call recording is off by default. When an organization turns it on, the AI agent is also instructed to say “This call is being recorded.”, and live call audio is kept only after its opening has finished playing. Voicemail messages are recorded whether or not call recording is on; Lina copies each one from Twilio into the call record and then deletes it at Twilio. A recording Lina has not copied stays at Twilio until the call record is deleted or the caller is erased.
- An organization’s own editable safety rules (for example on public positions) sit on top of this floor; they can add to it but cannot remove it.
03 — Access control & accountability
Roles checked by the server. Admin actions logged.
- Role-based access control (RBAC): admin, editor and viewer roles are enforced by the server on every Command Center API — not just hidden in the interface. Viewers are read-only.
- Features a plan does not include are refused by the server (HTTP 403), even if called directly.
- Passwords are stored as salted PBKDF2 hashes. Password-reset links are single-use and bound to their organization, and changing a password ends that account’s other sessions.
- An audit log records privileged admin actions, and sign-ins trigger alerts an organization can subscribe to.
- Payment and gift details in call records stay hidden in the Command Center unless an admin asks to see them.
- An admin can download all of the organization’s data as one file, and erase one person’s contact and call details. (Erasing a person does not rewrite chat transcripts; those conversations are deleted separately.)
04 — Secrets, AI providers & integrations
Keys stay on our side, and never come back out.
- API keys and tokens are stored as Railway environment variables — never in source code. The Command Center shows only whether each one is set, never its value, and our web application’s logs mask secret-shaped values.
- Lina runs the AI on its own provider accounts (Google Gemini and OpenAI). Your team never needs an AI provider account or API key.
- Every model call is written to the organization’s append-only usage ledger and checked against the plan’s monthly allowance; past it, the assistant stops calling the model instead of running up a bill.
- Incoming webhooks are verified: payment events are signature-checked, phone requests are signature-validated and rejected if they do not verify, and inbound email arrives HMAC-signed from our email worker.
05 — Transport
Encrypted in transit, strict in the browser.
- HTTPS everywhere. Railway provides and renews the TLS certificates for linasystems.org, every organization’s subdomain, and connected custom domains.
- Storefront and legal pages carry a strict Content Security Policy, and our pages load nothing from third-party servers — no trackers, no font or script CDNs.
- Public chat is rate-limited per visitor and per organization.
06 — Reliability & operations
Backed up nightly, deployed only when CI passes, watched from outside.
- Nightly backups: a GitHub Actions job takes a snapshot of the platform’s data, checks that it is complete, then restores it into an empty database to prove it works — a rehearsed restore, every night. Snapshots are private workflow artifacts, deleted after 30 days. If the backup or the rehearsal fails, the owner is emailed.
- Deploys: production deploys from the main branch and Railway is set to wait for CI, so a change ships only after the automated test suite (more than 5,000 automated tests) and secret scanning pass.
- Monitoring: an external uptime monitor on Cloudflare checks each Lina service every 5 minutes and emails the owner when one goes down and when it recovers. The application also emails the owner about server errors, billing events and failed backups.
- Rollback is by hand: the owner redeploys the last good version. There is no automatic rollback.
Our goals are to restore service within 4 hours of a major outage and to lose at most the last day of data, since backups are nightly. These are goals, not guarantees — Lina does not offer an uptime SLA, and we do not yet hold a third-party certification such as SOC 2.
07 — Responsible disclosure
Found a security problem? Tell us.
Email security@linasystems.org with what you found and the steps to reproduce it. We will acknowledge your report within 3 business days, keep you updated while we fix it, and credit you if you would like. Please test only against your own account: do not access or change other organizations’ data, degrade the service, or run automated scans against customer sites. We will not pursue good-faith research that follows these rules. Our contact details are also published at /.well-known/security.txt.
Questions from your security reviewer? Read the Data Processing Addendum, the Subprocessors list, the Privacy Policy and the Terms of Service, or reach us at hello@linasystems.org. We are happy to answer a security questionnaire.
Who it’s for
For teams reviewing organization isolation, staff access, backups, and AI disclosure before signing up.
How it works in 3 steps
- 1Choose your plan and sign up. If an invitation is required, request a code first.
- 2Add your organization’s knowledge and brand in the dashboard. See the setup guide.
- 3Share your web address and start answering from your knowledge. Phone and staff drafting tools are available on eligible plans; compare features.