Security
Where your data lives, and who can reach it.
Every other page says Lyto is EU-hosted. This page shows what that means, what we have built, and what we don't have yet.
Lyto stores and processes your data in the EU. The database is in Ireland and the app functions run in Frankfurt. Sign-in uses two-factor, and sensitive actions check it again. Data is encrypted at rest and in transit, and row-level security keeps each team's data apart. We tested production ourselves in August 2026. No third party has verified it yet.
Where your data lives
Your database, your sign-in and your uploaded files are kept by Supabase in Ireland (region eu-west-1). The app's server functions run on Vercel in Frankfurt (region fra1). Your data is stored and processed in the EU.
Static files, such as scripts, images and this website, are served from Vercel's global network.
The database is backed up every day, and each backup is kept for 7 days. Every company that handles your data for us is listed in section 6 of the privacy policy.
Signing in
- Two-factor sign-in works with an authenticator app. When you turn it on, you get recovery codes for the day you lose your phone.
- Sensitive actions need a session that passed the two-factor step. If yours didn't, Lyto first asks you to set up two-factor or enter your code.
- Session cookies are HttpOnly, so no script on a page can read them.
The bank link in Sum
Sum can link a business bank account through Enable Banking, a regulated provider in Finland. The bank link is not open to customers yet. Until it is, you import a bank statement as a CAMT.053, MT940 or CSV file.
This is how the bank link works:
- It is read-only. Sum reads balances and transactions, and it cannot move money.
- You sign in at your own bank. Lyto never sees or stores your bank password.
- You can end the link at any time, in Sum or at your bank.
Section 4 of the privacy policy lists what Sum stores from your bank and when it is deleted.
Encryption
Your data is encrypted at rest with AES-256 and in transit with TLS. It is stored on Supabase's infrastructure, which is certified for SOC 2 Type 2 and ISO 27001. Those certifications belong to Supabase. Supabase publishes the details at supabase.com/security.
Teams can't see each other's data
Every table that holds team data has row-level security. Before the database returns a row, it checks that the row belongs to your team.
How we test
In August 2026 we attacked our own production the way an attacker would. We tried account takeover, access across teams, injection and overload. We found 52 problems and fixed all of them.
This was our own work, and no third party has verified it. The changelog entry of 12 August 2026 has the details.
What we don't have yet
- A penetration test by an outside firm.
- A security certification of our own, such as ISO 27001 or SOC 2.
- A public status page.
Leaving
Sum exports the XAF 4.0 auditfile for your accountant, the journal as a CSV and every report as a CSV. After you cancel, you can still sign in and export everything. How long we keep your data after that is in section 8 of the privacy policy.
Report a problem
Found a security problem? Email a description, and the steps to reproduce it, to lytoapp@gmail.com. We reply within two working days.