Security Overview
Trust Pack: SEC-001 · Referenced by Privacy Policy (PP-001) and DPA (DPA-001)
Trust Pack: SEC-001 · Referenced by Privacy Policy (PP-001) and DPA (DPA-001)
This document summarizes security and data-handling controls for InfoSec and procurement reviews. It describes the current Lazarus Deal Recovery architecture — not a certification claim.
Lazarus Deal Recovery is a deterministic deal autopsy / revenue intelligence engine for stalled B2B pipeline. Customers assemble an evidence package from uploads, mailbox thread search, live meeting transcripts, field capture, optional HubSpot note import, and optional account-signal enrichment. A private API server transcribes audio (optional AssemblyAI), runs AI-assisted extraction (Layer 1), deterministic scoring (Layer 2), and returns a deal autopsy report with evidence quotes, People Map, Deal Risk Index (DRI), and recovery recommendations. Humans decide; Lazarus Deal Recovery does not send outreach or close deals autonomously.
| Included today | Not yet (roadmap) |
|---|---|
| Guest freemium analyses (five free) + optional Supabase Auth login; Stripe checkout exists for when volume requires paid plans | Unlimited public analyses without a plan |
| Account-scoped save of analyses for signed-in users (guests do not persist) | Org-wide multi-seat admin with SSO (SAML) |
| Per-deal autopsy from audio, transcript, Word/PDF, and email threads | Bi-directional CRM write-back / full Salesforce sync |
| Optional CRM deal-link metadata + deal lifecycle UI (in progress) | Always-on inbox scraping or silent mailbox webhooks |
| User-initiated Gmail / Outlook thread search (read-only OAuth) | Org-wide executive dashboard across full pipeline |
| Live meeting triage (Zoom RTMS; Meet / Teams where configured) | White-label partner console / multi-client branding |
| Optional HubSpot read-only deal + notes import | Autonomous AI SDR or automated outreach |
| Optional WhiteWhale account buying-signal enrichment on reports | SOC 2 Type II certification |
| Grounding audit + deterministic DRI / viability / trajectory | Encrypted OAuth token vault / formal pen-test report pack |
| Founder Ops Command Center (internal; founder/ops role only) | Customer-facing admin audit console |
The web console is display-only — scoring logic never runs in the browser. See Terms §1 and Privacy §2.
| Component | Role | Data access |
|---|---|---|
| Web console | Evidence intake, report display, optional login | No database credentials; calls private API only |
| API server | Transcription, Gemini extract, scoring, OAuth connectors, persistence, freemium limits | Service role (server-side only) |
| Supabase Auth + PostgreSQL | Optional login; RLS-isolated saves for signed-in users | Per-user rows via user_id; service role for API writes |
| Google Gemini | Text extraction API | Transcript / stitched evidence sent per request; zero-training config where available |
| AssemblyAI | Speech-to-text when Customer uploads audio | Audio buffer sent per request; not stored by Lazarus Deal Recovery |
| WhiteWhale (optional) | Account buying signals / Why Now | Company domain lookup when configured |
| Google (Gmail / Meet) | Optional read-only mailbox + meeting connect | User-authorized OAuth; thread text only when searched/attached |
| Microsoft Graph (Outlook / Teams) | Optional read-only mailbox + meeting connect | User-authorized OAuth; conversation text when searched/attached |
| Zoom | Optional live RTMS transcript stream | Webhook-authenticated live turns during an explicit session |
| HubSpot | Optional read-only deals + notes import | User-authorized OAuth; no CRM write scopes in the standard path |
| Mode | Auth | Persistence | Limits |
|---|---|---|---|
| Guest | None required | Analysis not saved to an account | Client + server freemium / soft rate limits |
| Signed-in (customer) | Supabase Auth | Analyses may be saved under user_id with RLS | Freemium soft limits unless on a paid plan (when offered) |
| Founder / ops | Supabase Auth + allowlist / role | Same persistence model; Ops Command Center for support | Founder demo account may be uncapped for demos |
Channels are user-initiated. Lazarus Deal Recovery does not silently scrape inboxes or join every meeting. Mailbox search attaches specific deal threads; live sessions require an explicit connect; field capture starts when the rep records.
| Channel | Access model | What leaves the source system |
|---|---|---|
| Gmail / Outlook | Read-only OAuth (gmail.readonly / Mail.Read) | Matching thread text the user searches and attaches |
| Zoom / Meet / Teams live | App / Graph scopes + session start | Live transcript turns for triage (not a Zoom recording archive) |
| Field capture | Browser recording the user starts | Short audio buffer → transcript; audio not the system of record |
| HubSpot notes | Read-only deals + notes scopes | Selected deal note text for historical context |
| Upload | Explicit file upload | Parsed document text or transcribed audio |
| WhiteWhale (optional) | Server-side API when configured | Account/domain signal summary for report enrichment |
| Class | Examples | Handling |
|---|---|---|
| Customer confidential | Recordings, transcripts, deal names | Encrypted in transit; stored only when signed-in save applies; RLS-isolated; retention-limited |
| Derived intelligence | Scores, DRI, People Map JSON | Stored per user when saved; no public model training |
| Anonymous metadata | Rescue outcome vectors (no transcript) | Retained post-purge for product analytics |
| Operational telemetry | API event logs for founder/ops | Internal diagnostics; not used to train public models |
| Credentials | API keys, service role | Environment variables; never in frontend |
| Control | Implementation |
|---|---|
| Encryption in transit | TLS 1.3 (HTTPS) for all client and API traffic |
| Encryption at rest | AES-256 via Supabase / cloud infrastructure |
| Tenant isolation | PostgreSQL RLS on customer tables; per-user rows when Supabase Auth + user_id are used |
| Privileged access | Service role bypasses RLS server-side only; RPC functions locked to service role; founder/ops routes require allowlisted login |
| Browser exposure | Service role and Gemini keys never shipped to client |
| AI data use | APIs configured for zero retention / no public model training where available |
| Anti-hallucination | Server-side grounding audit; invented content stripped before scoring |
| Retention | Default 30-day purge of raw transcript_text on saved records; analysis JSON retained until deleted |
| API hardening (prod) | Optional LAZARUS_API_KEY, CORS allowlist, cron secret for purge / alert jobs, freemium soft limits |
Same list as Privacy Policy §7. Primary hosting: North America.
Commonly requested — disclosed honestly in security reviews:
| ID | Document | Audience |
|---|---|---|
| ToS-001 | Terms of Service | All users |
| PP-001 | Privacy Policy | All users, DPOs |
| DPA-001 | Data Processing Addendum | B2B / enterprise |
| SEC-001 | This Security Overview | InfoSec, procurement |
| SEC-002 | Security Battlecard (founder-internal) | Founder account only — not a public Trust Pack link |
This overview is accurate to the current codebase. Have legal and security counsel review before submitting to regulated customers or RFPs that require formal certifications. Lazarus Deal Recovery is not SOC 2 certified today; hosting providers may maintain their own certifications.