Secure software development

Development

Lightning AI uses an agile development process, dividing new features across multiple iterations and releases. All development is done in-house, with developers undergoing secure software training upon hiring and periodically. Production data and environments are separated from development, QA, and staging. All code is stored in a source control system that requires single sign-on with multifactor authentication. Code merges need approval from relevant engineering owners and 2 peer reviews, with security-sensitive code manually reviewed by the product security team.

Quality assurance

We run quality checks, including unit, end-to-end, positive, regression, and negative tests, throughout the SDLC: at code merge, post-merge, release, and in production. We continuously monitor for issues, with alerts available on our status page. For any P0 or P1 issue, Lightning AI's automation triggers a "5 whys" root cause analysis, assigning a postmortem team member to lead the review. Findings are reported to leadership, and follow-up actions are tracked.

Release Management

Lightning AI has a formal release management process that includes a go/no-go decision before code releases. Changes undergo manual and automated testing to prevent regressions and ensure new features work with realistic workloads. We also use a staged rollout with monitoring to catch issues early. To maintain separation of duties, only our deployment management system can release changes to production, and multiperson approval is required for all deployments.

Documentation

The final phase of the SDLC is creating customer-facing documentation. Major changes require reviews from both the technical and documentation teams before merging and publishing. Visit our platform docs here.