Security
Lockstep's posture in one sentence: it can look, not touch. Everything below is shipped and verifiable in the open-source code — nothing on this page is aspirational.
Read-only connections
Every connector authenticates with read scopes. Lockstep never edits your messages, docs, or tickets. It writes back exactly three labeled things: a Slack message, a PR comment, and a conflict comment on your own PRD. Merged PRs are read — never modified — to record verified changes.
Allowlisted sources only
Lockstep reads exactly the channels, spaces, folders, and repos you point it at. Nothing is discovered or crawled. Remove a source and its future content never enters the pipeline.
Secrets redacted
Tokens, keys, and credential-shaped strings are stripped before anything is stored or sent to a model. Redaction happens at ingestion, not at display time.
Full audit trail
Every capture, confirmation, edit, rejection, and alert is logged with actor and timestamp. If a rule is in force, you can trace exactly who made it so, and when.
Walled projects, enforced in the database
Walled projects are visible to their members only — enforced with Postgres row-level security, not a UI filter. Briefings, digests, and drift alerts respect the wall. Other teams' agents never see inside.
Append-only history
Decision history is append-only: confirmations, versions, and supersessions are recorded, never rewritten. When a decision changes, the old one is superseded with lineage — not edited in place.
Your source stays yours
Lockstep never stores your source code. The PR check reads changed surfaces and decision metadata; what lands in the ledger is decisions and their source anchors.
Open source, self-hostable
Lockstep is Apache-2.0 on GitHub. Run it on your own infrastructure with docker-compose; the hosted version exists for walkthroughs.
Compliance, honestly
No SOC 2 yet — we are early, and we would rather say so than imply otherwise. If a certification is a hard requirement, self-host: Lockstep is Apache-2.0, runs with docker-compose on your own infrastructure, and your decisions never leave your company. Read the code on GitHub.