Security

Summary

The essentials of how we look after your data:

• We collect only the data needed to provide the service.
• The data and prompts you upload or monitor are yours. We process them solely to provide the service to you.
• We do not sell your data.
• Data is encrypted at rest and in transit.
• Internal access is restricted to authorized personnel, and we log who accesses data and when.
• We host on Supabase and Vercel, providers with SOC 2 Type 2 certification that offer data processing agreements (DPAs) for customers subject to GDPR.
• You can ask us for access, correction, deletion or export of your data. When you cancel, we delete your data within 30 days.

Hosting and region

The database and authentication run on Supabase, us-east-2 region (Ohio, on AWS). The application runs on Vercel, with functions pinned to the cle1 region (Cleveland), in the same zone as the database. Data is stored and processed in the United States. The full list of providers is on the Subprocessors page.

Encryption

All traffic between your browser and Lumen is encrypted in transit (HTTPS/TLS). Data is stored encrypted, and we apply encryption in line with accepted industry standards, strong encryption techniques and current security protocols.

Integration credentials (Google Search Console and GA4 OAuth tokens, and the Bing Webmaster API key) are encrypted at the application level with AES-256-GCM before being stored in the database.

Authentication and access

• Access to Lumen is through Google OAuth 2.0 or an email sign-in link (magic link). Lumen does not store passwords.
• Data for each account and each agency client is kept separate: only authorized members of that account can access it, enforced by row-level access rules in the database.
• Agencies control which team members access each client.

Integrations and permissions

Lumen can be used with just a domain, brand, competitors and prompts: connecting any account is not required.

• Google Search Console and Google Analytics 4 connect through OAuth with read-only scopes (webmasters.readonly and analytics.readonly). Lumen cannot modify your Search Console or Analytics account.
• Bing Webmaster and IndexNow are optional and, at your request, let you notify URLs to search engines.
• How to revoke: from Integrations you can disconnect each service, which deletes the connection stored in Lumen. For Google integrations you can also remove access from your Google account permissions.

Use of data

Customer data and prompts belong to the customer. We do not use them to train any AI model. Prompt text is sent to AI engines only to obtain their answers; processing by each provider is governed by its own terms (see Subprocessors). We may use prompts and execution results in aggregated, anonymized form to calculate market trends, produce studies and understand how AI engines behave. These statistics and studies do not identify any person, account, agency or client brand. They are not used to train models.

Retention and deletion

We keep your data while your account is active. When you cancel your account, data and prompts are deleted within 30 days, unless the law requires keeping them.

Incident handling

If we detect a security incident affecting customer data, the Lumen team investigates and contains it, and revokes any compromised credentials or access. We notify affected customers by email without undue delay and, at the latest, within 72 hours of becoming aware, stating what happened, which data is affected, what measures we took and a contact. We work with the agency so it can notify its own clients and the authorities where required.

Lumen team access to data

Only authorized members of the Lumen team can access customer data, and only for support, maintenance and security of the service. Every access is logged (who and when). Team accounts on the services that host the data use two-factor authentication.

Security contact

For security inquiries or to report a vulnerability, write to contact@getlumen.lat.