Security
Security practices at 3 Lions Design Studio. Learn how we protect your data, secure our infrastructure, and handle AI tools responsibly.
Our Security Commitment
At 3 Lions Design Studio, security is foundational to everything we build and deliver. As an AI-powered services company, we handle sensitive client data, proprietary business information, and advanced automation tools. We take that responsibility seriously.
Our security posture is built on four pillars:
End-to-end encryption, minimal data collection, and strict access controls for all client information.
Hardened hosting, regular patching, and proactive monitoring of all systems and services.
Responsible AI usage policies ensuring client data never trains third-party models without consent.
Clear reporting channels and good-faith response to security researchers and concerned parties.
Data Protection
We implement multiple layers of protection to safeguard your data at every stage:
- Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (SSL/HTTPS). We enforce HSTS headers to prevent downgrade attacks.
- Encryption at Rest: Sensitive data stored on our systems is encrypted using industry-standard AES-256 encryption.
- Data Minimization: We collect only the information necessary to deliver our services. We do not harvest data for advertising or sell it to third parties.
- Access Controls: Access to client data is restricted on a need-to-know basis. Anyone with access to sensitive systems uses multi-factor authentication.
- Data Retention: We retain client data only for as long as necessary to fulfill our service obligations and legal requirements. Project data is securely deleted upon request or after the agreed retention period.
Infrastructure Security
Our hosting and operational infrastructure is managed with security as a priority:
- Secure Hosting: Our website and services are hosted on professionally managed infrastructure with regular security patching and updates.
- Firewall Protection: Network-level firewalls and application-level security rules protect against unauthorized access, DDoS attacks, and common web vulnerabilities.
- Regular Updates: All software, libraries, and dependencies are kept up to date with the latest security patches.
- Monitoring: We monitor our systems for suspicious activity, unauthorized access attempts, and performance anomalies.
- Backups: Regular automated backups ensure business continuity and data recovery capabilities.
AI Tool Security Practices
As an AI-powered services company, we recognize the unique security considerations that come with using AI tools in client work:
- No Training on Client Data: We do not allow client data to be used for training third-party AI models unless the client provides explicit, informed consent. Where possible, we use enterprise-tier AI services with data processing agreements that prohibit model training on inputs.
- Prompt Injection Prevention: When building AI-powered solutions for clients, we implement safeguards against prompt injection and other AI-specific attack vectors.
- Output Verification: AI-generated deliverables undergo human review to ensure accuracy, appropriateness, and freedom from bias or hallucination before delivery.
- Vendor Assessment: We evaluate the security posture of all AI tool vendors we use, including their data handling practices, compliance certifications, and incident response procedures.
- Data Isolation: Client data processed through AI tools is isolated and not mixed with data from other clients or projects.
Responsible Disclosure
We value the security research community and welcome responsible disclosure of potential vulnerabilities in our systems.
Report a Vulnerability
If you believe you have discovered a security vulnerability on our website or in any of our systems, please report it to us responsibly. We ask that you:
- Allow us reasonable time to investigate and address the issue before any public disclosure
- Avoid accessing or modifying data that does not belong to you
- Act in good faith to avoid privacy violations, destruction of data, and interruption of services
Email: security@3lions.ca
We commit to acknowledging your report within 48 hours and providing a timeline for resolution. We will not pursue legal action against security researchers who act in good faith and follow responsible disclosure practices.
Incident Response
In the event of a security incident, we follow a structured response process:
- Detection and Containment: Immediately identify the scope and contain the incident to prevent further impact
- Assessment: Determine what data or systems were affected and the severity of the incident
- Notification: Notify affected clients and relevant authorities within the timeframes required by applicable privacy laws
- Remediation: Implement fixes to address the root cause and prevent recurrence
- Post-Incident Review: Conduct a thorough review to document lessons learned and improve our security posture
Contact Us
For security questions or concerns:
- Security Issues: security@3lions.ca
- General Questions: hello@3lions.ca
- Contact Form: 3lions.ca/contact