Trust

Security at Lobby

Lobby runs on the walls of your office. It pulls calendar data from your Google Workspace or Microsoft 365 tenant and renders it on e-ink displays outside every meeting room. That means we sit inside your identity perimeter, and we take that responsibility as seriously as you do.

Below is a scannable overview of how we protect your data. Every section opens up into a fuller explanation for the security-minded reader.

This page reflects the controls currently in place in production. Security is not a finish line — we review, test, and improve these controls continuously. If you are evaluating Lobby and need more detail than this page provides, contact security@usethelobby.com and we will walk your team through it.

Security at Lobby

We never touch your passwordsLobby has no password field, no password database, no reset flow. Sign-in is delegated entirely to Google Workspace or Microsoft 365.

We ask for the minimum access possibleSigning in requires only name and email. Calendar access is a separate, explicit, read-only step.

OAuth tokens are encrypted before they hit the databaseEvery refresh token is encrypted with AES-256-GCM before it is written to storage. A database dump without the key is useless.

If you revoke us, we notice — and we stopRevoked grants are detected on the next sync and the stored tokens are immediately cleared.

Every tenant is isolated from every other tenantEvery record is tagged with the organisation it belongs to, and every API call re-verifies that the caller is allowed to see it.

Sign-in sessions are locked downSession data lives on our servers. Cookies are HttpOnly, Secure, and SameSite=Lax, and every request re-validates them.

Displays are hard to hijackEach display has its own unique bearer token, and the rendering endpoint only accepts traffic from TRMNL’s infrastructure.

Public display URLs are safe to shareShareable URLs use 256-bit random tokens, and sensitive displays can be pinned to a known set of viewers.

We harden the edgesStrict CSP, X-Frame-Options: DENY, MIME-sniffing disabled, camera/mic/geo blocked, HTTPS-only cookies, no CORS.

Injection and output-escaping are handled at the framework levelParameterised queries everywhere. HTML-escaping on by default in every template.

Rate limits keep abuse outEvery sensitive endpoint has a per-IP rate limit, keyed on the real client IP — not a spoofable header.

Everything important is auditedSecurity-relevant events are recorded in an indexed audit log. Tokens, passwords, and full auth headers are never written to it.

Data deletion is deliberate and reversibleOrganisation deletion has a 48-hour grace period. After it expires, everything is removed atomically.

The cryptography we rely onAES-256-GCM for tokens at rest, HMAC-SHA256 for admin invites, 256-bit random tokens for public URLs, constant-time comparisons everywhere it matters.

Secrets live in the environment, not the repositoryRuntime secrets are environment variables, never committed to source. The app refuses to boot if any are missing.

Reporting a vulnerabilityEmail security@usethelobby.com. We acknowledge every report within two business days.