LockFlare secures the three surfaces a regulated organization runs in production — the servers, the applications on them, and the APIs and devices they talk to — from your side only. Nothing is installed on your servers, nothing is stored on ours, and nothing ever phones home.
Each solution covers one surface a regulated organization has to defend. What each one does, in plain words.
One desktop app that runs and hardens every Linux server you have, over the SSH logins you already use. Firewall, Fail2Ban, SSH hardening, users and certificates; MariaDB, MongoDB and Redis clusters built by dropping servers in; websites, mail, containers, VMs, WireGuard and backups; and Themis, an AI sysadmin that reads the box before it answers. Nothing is installed on any server. 10 servers free, forever.
Explore Vigia ↗
An API client — like Postman, Insomnia or Bruno — built for enterprises and regulated environments. REST and gRPC, Kafka, RabbitMQ and MQTT, Modbus, OPC UA, HART-IP and DDS: 74 protocols from one desk, with projects, credentials and secrets kept on your own side, never on a vendor's server. Imports Postman, Insomnia, Bruno, HAR and OpenAPI. Free forever up to 20 seats.
Explore Sonda ↗Deploys your Node.js, .NET and native applications to any Linux server as AES-256 ciphertext. The server decrypts the build in memory and serves it; the code is never written to disk in the clear. A hosting team can rack, reboot and monitor the machine and still cannot read or copy it. Confidential computing without the silicon.
Explore Cipher ↗
A workstation and a regulated enterprise should not be forced into the same infrastructure model. Nothing we deliver needs a server of ours.
Vigia runs on your Mac or Windows machine and speaks SSH to the servers you point it at. A reading is a command; a change is a script through sudo. No agent, no daemon, no listening port.
NOTHING INSTALLEDCipher installs a single binary in a two-minute terminal session. From then on the server pulls the encrypted build, decrypts it in RAM and serves. Restart it and it pulls again.
CIPHERTEXT AT RESTNo licence check, no telemetry, no update ping. A bought slot is a signed key opened on your own computer. We hold the email of your account and the keys issued to it — nothing else.
ZERO-KNOWLEDGELockFlare serves organizations whose security, privacy and deployment requirements cannot be outsourced to someone else's assumptions. Your fleet map, credentials and secrets live in a file on your computer, sealed under your key — there is no server of ours they were ever copied to.
Explore the Trust Center ↗Review the certificate and its scope through the Trust Center. Product features and deployment capabilities are documented separately.