# Security & Privacy at Lums ## How Lums Secures Your Data Lums is built with security and privacy at its core. This page explains how your financial data is collected, processed, stored, and protected across our platform. "Your financial data deserves real protection. That's why Lums is built on secure cloud infrastructure, encrypted systems at every layer, and strict access controls to keep your information safe, private, and under your control." Samuel Salazar, Technical Advisor & Board Member, Lums ## Our Core Security & Privacy Commitment At Lums, data protection is not a feature, it's built into our system from the ground up. ### What We Will Never Do - Sell your data to third parties - Share your information with advertisers or data brokers - Send your financial data to external AI providers (OpenAI, Anthropic, etc.) - Store or access your bank login credentials ### What We Always Do - Encrypt sensitive data at rest and in transit - Isolate each user's financial data - Limit access strictly to what is required for service operation - Provide full user control over data access and deletion - Maintain transparent security and privacy practices ## How Your Data Flows Through Lums ### Secure Bank Connection You connect your bank through Plaid's secure interface. Lums never sees or stores your bank credentials. Access is read-only. [Learn how Plaid secures bank connections](/content/en-us/your-privacy/plaid/index.html) ### Secured AI Processing Your data is processed securely within our Google Cloud infrastructure. It's never sent to external AI services, and is used only temporarily to generate your insights. ### Encrypted Data Storage Your transactions and balances are stored in an encrypted database with strict access controls. We never store sensitive banking information such as full account or card numbers. ### Full User Control You can disconnect accounts, clear your data, or delete your account at any time, right away. [View full data flow & security architecture](/content/en-us/your-privacy/data-flow/index.html) ## Who Has Access to Your Data Lums limits data access strictly to what is required to operate the platform securely. Only two external service providers are involved in specific, controlled parts of the process. ### Services We Use (And Why) | Service | What They Access | Why We Use Them | Security Standards | |---------------|------------------------------------------------------|---------------------------------------|----------------------------------------------------------| | Plaid | Transaction data you authorize directly with your bank | Secure, read-only bank connections | PCI DSS compliant, used by Venmo, Robinhood, and 8,000+ apps | | Google Cloud| Infrastructure hosting for our secure AI, databases and services.| Enterprise-grade cloud computing and security | SOC 2 Type II, ISO 27001, PCI DSS Level 1 | ## Security Features That Protect You ### Multi-Layer Authentication #### User protection - Secure OAuth2 login via Google, Facebook, and Apple - JWT-based authentication - Automatic logout after 1 hour of inactivity #### Server protection - Rate limiting to prevent brute-force attacks - Strict API request validation - Continuous audit logging with all sensitive data fully redacted ### Encryption at Every Level #### Data at rest - Access tokens encrypted using AES-256-GCM - Industry-standard encryption for databases - Credentials and sensitive tokens are stored securely with layered encryption and strict access controls. #### Data in transit - All network traffic protected by HTTPS/TLS - No unencrypted data transmission at any point ### Continuous Monitoring & Detection #### We actively monitor - Suspicious login behavior - Unusual API activity - Infrastructure health and system performance - Security vulnerabilities and anomalies #### We safely log - Authentication events - API requests (with no sensitive data) - System errors for debugging and reliability - All logs exclude passwords, tokens, and account numbers ## Your Privacy Rights You remain in full control of your data at all times. ### Access - View all personal and financial data associated with your account - Request a copy of your information at any time - Data export in CSV format (coming soon) ### Portability (Coming Soon) - Download your data in standard formats - Transfer your information to another service at any time - No proprietary lock-in ### Deletion - Delete your account with one click - All associated data permanently erased within 1 hour - Includes transactions, bank connections, and conversation history ### Correction - Edit transaction categories - Add personal tags and notes - Manually override automated categorization ## Compliance & Certifications ### Industry Standards - Plaid (Bank Connections): PCI DSS compliant and trusted by over 8,000 financial applications - Google Cloud (Infrastructure): SOC 2 Type II, ISO 27001, and PCI DSS Level 1 certified - Database & Authentication: Enterprise-grade security practices ### Data Privacy - All data is stored in secured United States data centers - Committed to the privacy principles outlined in GDPR and CCPA - Full user rights over data access, deletion, and control ### Ongoing Security Practices - Continuous security monitoring - Automated vulnerability scanning - Regular security updates and infrastructure patching - Encrypted data storage and transmission ## Our Security Commitment Security at Lums is not a one-time effort. It is an ongoing responsibility. We commit to the following principles: ### Continuous Improvement Ongoing security audits, infrastructure updates, and system hardening. ### Transparency Clear communication about how your data is handled and protected. ### Rapid Response Immediate investigation and action on any potential security issue. ### User Control You retain full ownership and control over your data at all times. ### Privacy First We never sell your data or monetize your information through advertising. ## Report a Security Concern We take all security reports seriously and actively encourage responsible disclosure. To report a security issue or general privacy questions: Email us at [hello@lums.ai](mailto:hello@lums.ai) Response within 24 hours ### Stay Informed We keep users informed about important security and privacy changes. - Notification of significant security updates - Privacy policy updates published 30 days in advance - Optional newsletter for security and privacy updates Last updated: November 30, 2025.