Security

Your keys stay yours. Your team stays in charge.

Credentials are encrypted and used by name, so neither your AI nor your teammates see them. Roles decide who can change what, and on Pro your identity provider decides who gets in.

Start FreeBook a demo

Credentials encrypted in transit and at rest.

Where your key goes

Pasted once. Used by name from then on.

Follow a Stripe key from the moment you add it to the record of the run that used it.

  1. In the New Secret form
    Valuesk_live_51NqAx8F2kQ…Stored encrypted. You won't be able to view it again after saving.

    You paste it once

    Add it in Secrets and Values. Once saved, no screen or API shows it again.

  2. In Secrets and Values
    STRIPE_KEY Encrypted

    Lodol keeps it encrypted

    It goes to an encrypted secret store, and Lodol's database keeps only a pointer. On Enterprise it can stay in your own vault.

  3. In your workflow
    @secrets.STRIPE_KEY

    Everything else uses its name

    Your workflows, and the AI that builds them, refer to it as @secrets.STRIPE_KEY. Nothing your AI can call reads the value.

  4. In the run's record
    ***

    Runs use it. Records don't.

    A step gets the value only while it runs. If it shows up in output, an error or an email, it's masked.

Shut by default

Closed until you open it

API keys, code steps and preview links start with the least they need. Anything more is a choice.

  • API keys that do one job

    Give each key only what it needs and an expiry from 30 days to a year. Deleting is off unless you turn it on.

  • Code that can't reach out

    Python steps run sealed off: no network, none of the server's secrets, hard limits on time and memory. Only your inputs go in.

  • Private until you share it

    Every workflow starts private. Make it public and anyone with the preview link can view it, until you make it private again.

Who can do what

Everyone can see what happened. Only the right people can change it.

Pick a role to see what it allows. On Pro you can make your own, down to the folder.

Roles

Admin: 16 of 20 permissions.

Workflows

  • Create workflows
  • Edit workflows
  • Run workflows
  • Delete workflows
  • Delete runs
  • Manage integrations
  • Manage stored secrets
  • Manage stored values

Members

  • Manage members
  • Sign out members
  • Manage roles

Apps

  • Use apps
  • Publish apps publicly

Workspace

  • Manage billing
  • Manage workspace settings
  • Manage security policy
  • View audit logs
  • Access all folders and items
  • View all connections

Developer API

  • Manage API keys
For your identity and security teams

The controls they'll ask about

Which plan each one is on, straight from the pricing page.

Visit the trust portal
Security controls by plan
CapabilityFreeBuilderProEnterprise
Encrypted secretsAPI keys, passwords, and sensitive credentials are encrypted at rest.
Two-factor authenticationAdd an extra layer of account security with a second verification step during login.
Admin and Viewer rolesFree has an Owner and Members. Paid plans add Admins, who manage members and settings alongside the Owner, and Viewers, who only need to follow along, like ops and finance: they see workflows, runs and apps, and can't change anything.
Custom roles and folder access controlsCreate custom roles with exactly the permissions each member needs, beyond the built-in Owner, Admin, Member and Viewer, and choose who can open each folder, workflow, app and document.
Single sign-on (SAML or OpenID Connect)Sign in through your company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace, over OpenID Connect or SAML, and require it of your workspace's members.
SCIM provisioningYour identity provider adds people to your workspace when they're given access, removes them when they lose it or leave, and sets their role from the groups it has them in.
Security policiesRules everyone in your workspace has to meet: require two-factor authentication or single sign-on, allow only your email domains or IP addresses, sign people out after a time, and turn off public links.
AI app access controlsTurn off AI tool access to your workspace, or allow only the AI apps you choose.
Activity audit log and exportSee who did what in your workspace, and export it for compliance, security, and operational review. Every entry is kept this long, then deleted for good.2 years2 years
Log streamingSend your audit log and workflow runs to your own SIEM or log platform, such as Datadog, Splunk or Sentry, as they happen.
External secret storesKeep credentials in your own HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Cloud Secret Manager, 1Password, Infisical or CyberArk Conjur. Workflows read them when they run, so Lodol never holds a copy.
Compare every plan

Questions security teams ask

No. Keys are stored as encrypted secrets that workflows use by name. An AI tool building a workflow sees the names, never the values.

On Pro and Enterprise, admins can turn off AI tool access to the workspace, or allow only the AI apps they choose. On every plan, a connected tool can only do what its person's role allows.

On Pro and Enterprise. Members sign in through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace, over SAML or OpenID Connect, and you can require it. SCIM adds and removes people and sets their roles from your groups.

On Enterprise. Workflows can read credentials from your own HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Cloud Secret Manager, 1Password, Infisical or CyberArk Conjur when they run, so Lodol never holds a copy.

Our trust portal, trust.lodol.com, is where we publish our security details. For anything it doesn't answer, talk to us and we'll put you in touch with the right person.

Ask your AI for your first automation.

Connect it in one step. Your AI builds the workflow, and Lodol runs it and tells you if anything breaks.

Start FreeTalk to Us

Free plan, no credit card · Credentials encrypted in transit and at rest · Security and trust