SECURITY
Technology should earn your trust.
This page describes protections that are implemented today. We don't claim certifications we don't hold.
Encryption in transit
All traffic is served over HTTPS with HSTS. Session cookies are HttpOnly, Secure and SameSite.
Password protection
Passwords are hashed with Argon2id. We enforce a strong password policy and never store or log plaintext passwords.
Two-factor authentication
Authenticator-app (TOTP) MFA with single-use recovery codes, available to every customer and mandatory for Lunxa staff.
Workspace isolation
Every request checks workspace membership and role on the server. Non-members receive “not found” — guessed URLs and modified IDs don't reveal data.
Permission-aware AI
Lunxa AI retrieves only documents the requesting user may read. Administrators have no implicit access to customer content.
Private file storage
Files live in private object storage and are served with short-lived signed links after authorization. File types and sizes are validated.
Secrets encryption
Integration tokens and MFA secrets are encrypted with AES-256-GCM before storage.
Abuse protection
Rate limits on sign-in, registration, password reset, AI and forms; account lockout for administrator accounts; suspicious-login alerts.
Audit logging
Privileged operations are recorded in an append-only audit log protected at the database level.
Verified payments
Card data is handled by our payment processor. Payment webhooks are signature-verified and processed exactly once.
Hardened responses
Content-Security-Policy, frame protection, strict referrer policy and CSRF origin checks on every state-changing request.
Your controls
- • Review and revoke active sessions in Settings → Security
- • Export your account data in Settings → Privacy
- • Delete your account (14-day grace period)
- • Switch AI access off for any document
- • Make projects and documents private
- • Reject optional cookies at any time
Certifications
Lunxa does not currently hold SOC 2, ISO 27001 or similar certifications. We'll announce any certification only after an independent audit is complete.
Security disclosure policy
If you believe you've found a vulnerability, email security@lunxa.com or use the contact form (category Security).
- Scope: lunxa.com, app.lunxa.com and admin.lunxa.com.
- Please: give us reasonable time to fix issues before disclosure, avoid privacy violations and service disruption, and only test against accounts you own.
- Out of scope: denial-of-service, social engineering, physical attacks, and findings from automated scanners without a proof of impact.
- Our process: we acknowledge reports, investigate, keep you informed, and credit researchers who wish to be named.