Lavawall® was built from the ground up with the Minimum Viable Secure Product requirements in mind.

Some of the controls we implemented include:

• PassKeys as the preferred primary authentication at no additional cost
• Single Sign-on using modern, maintained, and industry-standard protocols for all customers at no additional cost
• Multi-Factor Authentication as a non-negotiable default
• Encrypting communications the same way as TLS again within the TLS tunnel, so we can allow TLS inspection without breaking like Huntress or disclosing security vulnerabilities to eavesdroppers.
• Encouraging external vulnerability reports and customer testing
• Passwords checked against popular disclosed passwords, hashed before they leave your computer, and then stored using Argon2id
• Not requiring the use of passwords at all. We consider them a temporary backup authentication in case you can't use passkeys or SSO.

Lavawall® scanning computers are on dedicated servers in Calgary, Alberta, Canada.
Lavawall® databases and front-end systems are hosted with AWS in Montréal, Québec, Canada.
We send emails through AWS in Ireland and dedicated servers in Calgary, Alberta, Canada.
We send text messages for additional identity verification through Twilio in the United States.
We store executables and pass requests through Cloudflare at your nearest edge location.
We use Cloudflare for risk management, turnstile, and web application firewall services.
We use LeadPages for landing pages.
We use Google and Facebook for analytics on our public-facing pages, but they do not have access to the console.
We integrate with third-party tools, such as Microsoft, Google, Huntress, Screen Connect, Axcient, and Datto in their respective locations. However, you must initiate these integrations through single sign-on or by enabling them in your Lavawall® console.

Please report bugs through our contact form.
For urgent security issues, lease call us at 1-403-538-5053 and select 1 or say support.

Please note that your IP address will be banned for doing generic vulnerability scans and high-volume scans/denial of service attacks.

Given that we are in the initial launch, our compensation structure is very dynamic. In all cases, however, we will publicly acknowledge your contribution in our Change Log and welcome any suggestions.

We encourage primary authentication for Lavawall® through Passkeys or Single Sign On (SSO).
However, we do allow passwords and use passwords as part of the zero-knowledge encryption for your clients' sensitive data, such as Bitlocker keys and Personally-Identifiable Information (PII).
These passwords use Argon2id slow hashes with individual salts and peppers. They go through a few hash rounds on your computer before being sent to our servers for further hashing.

Yes! Lavawall communicates with its endpoints through TLS. However, given that many of our clients want to be as secure as possible and have TLS inspection enabled, we allow for "insecure" connections with invalid certificates, which result from such configurations.
We have added an additional secure tunnel that mimics the TLS process within the public TLS tunnel. This extra tunnel provides authentication and privacy for the workstations and the Lavawall® servers to prevent attacks such as the one that took down Solar Winds.

We do not enable remote access tools like ScreenConnect unless you authorize them and are logged in. Lavawall® was not vulnerable to the ScreenConnect vulnerability because we install and uninstall it right before it's used. In addition, we give the option of linking to Access.

Remote access is not enabled for read-only and audit situations.

Lavawall®'s designer holds a CISSP and CISA. In addition, we have external and internal security reviews.