Security

Locus Technologies Inc. ("Locus") operates payment infrastructure that lets AI agents transact autonomously within limits their owners control. Because we work at the intersection of payments, cryptography, and autonomous software, security is foundational to how the platform is built. This page describes the technical and organizational measures we use to protect customer data, funds, and systems. It is maintained by the Locus security team and reflects our current practices.

1. Our Approach

We protect customer data and funds through a non-custodial architecture, hardware-backed key management, encryption by default, least-privilege access, and a reviewed, automated software-delivery process. Wherever possible, security is enforced by the architecture — isolated infrastructure, keys that never leave their secure enclave, and on-chain spending policies — rather than by manual process alone.

2. Infrastructure & Hosting

• Locus is hosted on Amazon Web Services in the United States. We do not operate our own data centers.
• Application services run as containers on AWS ECS Fargate inside a private virtual network (VPC). Our PostgreSQL database (Amazon RDS) and cache (Amazon ElastiCache for Redis) reside in private subnets and are not reachable from the public internet.
• Static frontends are served over Amazon CloudFront. Production and non-production environments are isolated.
• Access to AWS services is scoped per workload using least-privilege IAM roles.

3. Encryption in Transit

• All connections to Locus — websites, dashboards, and APIs — are served exclusively over HTTPS using TLS 1.2 or higher.
• Database connections require TLS in production.
• HTTP security headers are applied to API responses, and cross-origin access is restricted to an allowlist of trusted origins.

4. Encryption at Rest

• Our primary database and object storage are encrypted at rest using AES-256, with keys managed by AWS Key Management Service (KMS).
• Sensitive application data fields are additionally encrypted at the application layer using AES-256-GCM.
• Application secrets and credentials are stored in AWS Secrets Manager (KMS-encrypted) and injected into services at runtime; they are never committed to source control.

5. Key Management & Non-Custodial Wallet Security

• Non-custodial by design. Agents transact from smart-contract wallets (ERC-4337 account abstraction) that the customer controls. Locus does not take possession of, or control over, customer funds. Where custodial features are offered, custody is provided by regulated third-party partners under their own terms.
• Keys never leave their enclave. Wallet signing keys (session keys and permissioned keys) are generated inside AWS KMS and never leave KMS in plaintext. Locus stores only a reference to each key (its KMS identifier), not the key material itself.
• Isolated signing. Transaction signing is performed by isolated serverless functions that call KMS to sign; the main application never handles raw private keys.
• Defense in depth. Every transaction is additionally constrained on-chain by the spending policies attached to the wallet (see Section 7), so even a compromised application path cannot exceed a customer's configured limits.
• Credential hashing. API keys for programmatic and agent access are stored only as SHA-256 hashes (with a short, non-secret prefix for identification) — never in plaintext. Escrow claim passcodes are stored as bcrypt hashes.

6. Authentication & Access Control

• User accounts are managed by AWS Cognito. Passwords use Cognito's Secure Remote Password (SRP) protocol and are never stored by Locus. Google OAuth sign-in is supported.
• Optional time-based one-time-password (TOTP) two-factor authentication is available for accounts.
• Authenticated sessions use signed, expiring JSON Web Tokens (JWTs); machine-to-machine and agent access uses scoped API keys.
• Internal access to production follows least privilege and is limited to what is required to operate the service.

7. Payment Controls & Transaction Integrity

• A three-layer spending-policy engine evaluates every transaction against (i) account-level limits, (ii) per-wallet budgets, and (iii) policy-group controls. Transactions that exceed configured limits are automatically declined.
• Automated OFAC sanctions screening is performed before applicable transactions.
• Every transaction is recorded with the initiating user or agent, amount, counterparty, timestamp, status, and — for agent actions — the agent's stated reasoning, producing a complete audit trail.
• On-chain settlement occurs on Base (an Ethereum Layer 2). On-chain records are public and immutable, providing independent verifiability.

8. Card Data & PCI

For prepaid virtual-card and bring-your-own-card features, card data is tokenized and stored by Basis Theory, a PCI-DSS Level 1 certified vault provider. Raw card numbers, expiration dates, and security codes are transmitted directly to Basis Theory; Locus never receives, processes, or stores raw card data, only tokenized references. This keeps cardholder data out of Locus's systems.

9. Secure Development & Change Management

• All code changes go through version control and pull-request review.
• Continuous integration runs automated linting/formatting and build checks on every change; these must pass before a change can merge.
• Deployments use a managed CI/CD pipeline with blue/green releases. AWS credentials in CI are obtained via short-lived OIDC tokens — no long-lived AWS keys are stored in the pipeline.
• Database migrations run in a gated pre-deployment step that blocks the release if a migration fails.

10. Monitoring, Logging & Incident Response

• Application and infrastructure logs are centralized in Amazon CloudWatch; AWS account activity is recorded in AWS CloudTrail.
• We monitor service health and investigate anomalous activity. If we become aware of a security incident affecting your data, we will investigate, contain it, and notify affected customers without undue delay, consistent with our Privacy Policy and applicable law.

11. Data Retention & Deletion

We retain data only as long as necessary to provide the service and meet our legal and compliance obligations, after which it is deleted or de-identified. Certain records — for example, blockchain transactions — are immutable and permanently public on-chain. Retention periods are documented, and secure disposal is performed in accordance with our SOC 2 controls. See our Privacy Policy for details and how to request deletion.

12. Sub-processors & Vendor Management

We use a vetted set of service providers to operate Locus, including AWS (cloud hosting, identity, and key management), Cloudflare (CDN), Basis Theory (PCI card vault), SendGrid (email), Twilio (SMS), and blockchain infrastructure providers. These providers are bound by contractual obligations to protect the data they process on our behalf. For the categories of data shared with each, see our Privacy Policy.

13. Compliance

Locus is currently undergoing a SOC 2 Type II audit conducted by an independent third-party auditor. As of June 8, 2026, the audit is in progress and certification has not yet been obtained. Locus intends to make the SOC 2 report available to qualified customers and prospects under a non-disclosure agreement upon completion. This disclosure does not constitute a representation that Locus has achieved or will achieve SOC 2 certification.

Locus currently offers the Service in the United States and Canada and aligns its privacy practices with the CCPA/CPRA and Canada's PIPEDA. For full details, see our Privacy Policy and Terms of Service.

14. Reporting a Security Issue

We welcome reports from security researchers. If you believe you have found a vulnerability, please email security@paywithlocus.com with details and steps to reproduce. We will acknowledge your report, investigate, and keep you informed of our progress. Please give us a reasonable opportunity to remediate before any public disclosure, and do not access, modify, or delete data that is not yours while testing.