Trust and security
Answers for your security review, in one place
How Lumen handles your data, who can access it, and what the agent is allowed to do on its own.
Data
How your data is handled
Plain answers to the four questions every review starts with.
Where it lives
Your data stays in the US or EU region you choose at setup.
How long we keep it
30 days by default. Set a shorter window per agent, or delete on request.
How it is protected
TLS 1.2 or higher in transit and AES-256 at rest.
Model training
Your data is never used to train models. Not ours, not anyone else’s.
Permissions
What the agent can and can't do
Set what each agent can read, draft and send. Anything risky waits for a person to approve it.
Referral agent · Health team
5 rules
Allowed
Allowed
Needs approval
Needs approval
Never
Audit log
Access and audit
See what the agent read, what it wrote and who signed off. Export the full record for any review.
Today · Health team
Export CSV
9:42
Referral agent read 42 letters
9:44
Draft summary created
9:51
Summary approved and sent
10:03
Alert #4471 marked benign
10:15
Policy reply edited, then sent
Access
Only the right people, and a record of what they did
Single sign-on
SAML and OIDC with your identity provider. People join and leave through the tools you already manage.
Role-based access
Decide who can run an agent, who can approve its work and who can change its rules.
Audit log export
Every read, draft and approval, exported as CSV or sent to your SIEM.
Compliance
The documents your reviewer will ask for
We share current reports under NDA, and only list certifications we actually hold. Questions go straight to security@lumen.example.
Data handling overview
On request
Subprocessor list
On request
Penetration test summary
On request
Data processing agreement
On request
FAQ