Security & Privacy at Lums
How Lums Secures Your Data
Lums is built with security and privacy at its core. This page explains how your financial data is collected, processed, stored, and protected across our platform.
"Your financial data deserves real protection. That's why Lums is built on secure cloud infrastructure, encrypted systems at every layer, and strict access controls to keep your information safe, private, and under your control."
Samuel Salazar, Technical Advisor & Board Member, Lums
Our Core Security & Privacy Commitment
At Lums, data protection is not a feature, it's built into our system from the ground up.
What We Will Never Do
- Sell your data to third parties
- Share your information with advertisers or data brokers
- Send your financial data to external AI providers (OpenAI, Anthropic, etc.)
- Store or access your bank login credentials
What We Always Do
- Encrypt sensitive data at rest and in transit
- Isolate each user's financial data
- Limit access strictly to what is required for service operation
- Provide full user control over data access and deletion
- Maintain transparent security and privacy practices
How Your Data Flows Through Lums
Secure Bank Connection
You connect your bank through Plaid's secure interface. Lums never sees or stores your bank credentials. Access is read-only.
Learn how Plaid secures bank connections
Secured AI Processing
Your data is processed securely within our Google Cloud infrastructure. It's never sent to external AI services, and is used only temporarily to generate your insights.
Encrypted Data Storage
Your transactions and balances are stored in an encrypted database with strict access controls. We never store sensitive banking information such as full account or card numbers.
Full User Control
You can disconnect accounts, clear your data, or delete your account at any time, right away.
View full data flow & security architecture
Who Has Access to Your Data
Lums limits data access strictly to what is required to operate the platform securely. Only two external service providers are involved in specific, controlled parts of the process.
Services We Use (And Why)
| Service | What They Access | Why We Use Them | Security Standards |
|---|---|---|---|
| Plaid | Transaction data you authorize directly with your bank | Secure, read-only bank connections | PCI DSS compliant, used by Venmo, Robinhood, and 8,000+ apps |
| Google Cloud | Infrastructure hosting for our secure AI, databases and services. | Enterprise-grade cloud computing and security | SOC 2 Type II, ISO 27001, PCI DSS Level 1 |
Security Features That Protect You
Multi-Layer Authentication
User protection
- Secure OAuth2 login via Google, Facebook, and Apple
- JWT-based authentication
- Automatic logout after 1 hour of inactivity
Server protection
- Rate limiting to prevent brute-force attacks
- Strict API request validation
- Continuous audit logging with all sensitive data fully redacted
Encryption at Every Level
Data at rest
- Access tokens encrypted using AES-256-GCM
- Industry-standard encryption for databases
- Credentials and sensitive tokens are stored securely with layered encryption and strict access controls.
Data in transit
- All network traffic protected by HTTPS/TLS
- No unencrypted data transmission at any point
Continuous Monitoring & Detection
We actively monitor
- Suspicious login behavior
- Unusual API activity
- Infrastructure health and system performance
- Security vulnerabilities and anomalies
We safely log
- Authentication events
- API requests (with no sensitive data)
- System errors for debugging and reliability
- All logs exclude passwords, tokens, and account numbers
Your Privacy Rights
You remain in full control of your data at all times.
Access
- View all personal and financial data associated with your account
- Request a copy of your information at any time
- Data export in CSV format (coming soon)
Portability (Coming Soon)
- Download your data in standard formats
- Transfer your information to another service at any time
- No proprietary lock-in
Deletion
- Delete your account with one click
- All associated data permanently erased within 1 hour
- Includes transactions, bank connections, and conversation history
Correction
- Edit transaction categories
- Add personal tags and notes
- Manually override automated categorization
Compliance & Certifications
Industry Standards
- Plaid (Bank Connections): PCI DSS compliant and trusted by over 8,000 financial applications
- Google Cloud (Infrastructure): SOC 2 Type II, ISO 27001, and PCI DSS Level 1 certified
- Database & Authentication: Enterprise-grade security practices
Data Privacy
- All data is stored in secured United States data centers
- Committed to the privacy principles outlined in GDPR and CCPA
- Full user rights over data access, deletion, and control
Ongoing Security Practices
- Continuous security monitoring
- Automated vulnerability scanning
- Regular security updates and infrastructure patching
- Encrypted data storage and transmission
Our Security Commitment
Security at Lums is not a one-time effort. It is an ongoing responsibility. We commit to the following principles:
Continuous Improvement
Ongoing security audits, infrastructure updates, and system hardening.
Transparency
Clear communication about how your data is handled and protected.
Rapid Response
Immediate investigation and action on any potential security issue.
User Control
You retain full ownership and control over your data at all times.
Privacy First
We never sell your data or monetize your information through advertising.
Report a Security Concern
We take all security reports seriously and actively encourage responsible disclosure.
To report a security issue or general privacy questions:
Email us at hello@lums.ai
Response within 24 hours
Stay Informed
We keep users informed about important security and privacy changes.
- Notification of significant security updates
- Privacy policy updates published 30 days in advance
- Optional newsletter for security and privacy updates
Last updated: November 30, 2025