The Nerdy Stuff
Your information deserves thoughtful protection. Here is how the app is built, what each layer does, and where its limits are.
Protection in layers
Cloudflare hosts the app on Workers, D1, and private R2 storage. LAP adds account checks, restricted sharing, encryption for sensitive stored content, and request limits. EpochShield provides an additional security integration. These layers serve different purposes; no single layer makes any system risk-free.
- Encrypted connections
- HTTPS/TLS protects data moving between your browser and LAP. The app redirects HTTP requests to HTTPS and sends HSTS headers.
- Encrypted storage
- Cloudflare documents encryption at rest for D1 and AES-256 encryption at rest for R2. This helps protect stored database and file contents.
- Additional content encryption
- Saved private buying profiles and uploaded document bytes use AES-256-GCM with separate configured secrets. Authentication tags and record-specific context help detect altered content or content substituted into another record.
- Controlled sharing
- A signed-in account and current ownership or an accepted, scoped invitation determine access. An agent invitation does not open the buyer’s private income, credit, cash plan, or entire Drive.
Other encrypted app records use the installed authentication library’s authenticated-encryption helpers. Account and routing metadata, such as your email, role, record IDs, and timestamps, are needed for operation and are not all separately encrypted by the app. Authorized server processing can decrypt relevant content; this is not end-to-end encryption.
Who can reach the database?
Your browser talks to restricted LAP endpoints. It does not receive a D1 database credential, SQL console, or general-purpose database query endpoint. Database statements run in the Worker through its private D1 binding, with account and ownership checks and bound SQL parameters.
Unauthorized remote database access is denied. Authorized Cloudflare account operators can still use Cloudflare’s authenticated dashboard, API, or Wrangler tools. We do not claim that all remote access is disabled. Protecting operator accounts and API tokens remains essential.
Sign-in and browser protections
LAP password sign-in requires a verified email. Passwords are hashed by the authentication library rather than saved as readable passwords. Session cookies use HttpOnly, Secure on HTTPS, and SameSite protections. Password resets revoke existing sessions.
Configured Cloudflare Turnstile checks help protect login flows. Request-size limits, authentication rate limits, same-origin checks for sensitive writes, and a restrictive Content Security Policy provide additional controls. Management access uses separate authorization and MFA checks.
After 15 minutes without activity, a three-minute countdown asks if you want to stay signed in. When time runs out, the current session is revoked. The server checks the idle deadline on protected requests as well as the browser showing the warning. Network trouble locks the visible workspace until access or sign-out can be confirmed. Other signed-in devices have their own sessions.
What EpochShield does
The integration can observe limited security events through a private Worker service binding. Its status distinguishes monitoring from sign-in enforcement. Monitoring helps provide visibility; it does not mean every threat is blocked.
When explicitly configured and healthy, the separate sign-in policy can enforce its supported sign-in rate rule. A disabled or unavailable integration is reported as such. The security-status indicator shows the current reported mode. We do not describe monitoring-only mode as enforcement.
EpochShield is separate from document virus inspection. Uploaded files stay quarantined. PDF checks are available only when the private scanner is configured and activated; a scan result does not by itself release a file. Inspection and active-content removal for every accepted file type are not yet complete.
Your documents and team
Drive uploads are encrypted before private R2 storage. The upload workflow does not publish a public file URL. File-size and account quotas limit intake. Uploading a file is not a promise that it is safe: quarantine, scan freshness checks, and restricted release paths are separate safeguards.
Property messages are limited to the current permitted participants. A concessions message requires you to select an assigned buyer agent, review the exact text, and confirm sending it. A team invitation or account login does not automatically share your entire financial profile.
Delete your account
You can start deletion from My account → Delete my account. Enter your account email, read the explanation, and confirm. For protection, an initial deletion request requires a login within the last 10 minutes.
Successful deletion removes the live account, sessions, owned app records, and known private uploaded files. File cleanup is checked before the account is removed. If cleanup fails or an upload is still in progress, the account stays locked and deletion is shown as pending so you can retry.
Security/audit records, permanently reserved agent identities and review history, copies held by other people, email suppression keys, and provider backups may remain under their retention rules. Deletion cannot recall a message or document someone already received. Cloudflare recovery history can retain previous database states for its applicable retention window; an instant, irreversible wipe of every historical copy is not promised.
On confirmed deletion or idle sign-out, LAP asks the browser to clear this origin’s cookies, cache, and storage. The app also clears its own stored browser preferences after confirmed deletion. Browser support and settings affect clearing; it cannot remove a saved browser password, your downloads, another device’s storage, or cookies belonging to your identity provider. New logins create fresh sessions.
Read the technical sources
These are Cloudflare’s product descriptions, rather than an independent audit of LAP Advisor.