Security Statement
This page lists only what we can point to in how this website is built and hosted. It is not a certification, audit report or compliance claim, and it does not describe our other products.
This website
- The site and the project request form run on Amazon Web Services: the site on a managed serverless Next.js deployment, the form on an API Gateway endpoint backed by a Lambda function.
- Form submissions are saved in a DynamoDB table in our AWS account, and notification emails go out through Amazon SES.
- The form handler checks every submission against a schema on the server before storing it, and quietly discards submissions that fill a hidden bot-trap field.
- The webhook address for our internal Slack notification is kept as a deployment secret, not in the website's source code.
- The production deployment is configured with deletion protection, and its data is retained if the stack is removed.
What the form collects and where it goes is described in the Privacy Policy.
Our other products
Token Holder, KnowMessenger and MASS Lab Connect are separate products with their own sites. Please read what each one says about security there; we make no claims about them on this page.
To report a security concern, email security@themasslab.com or hello@themasslab.com.
Last updated: October 10, 2026