Security
Security
Lumen Sieve is built security-first. Here's how we protect your data and what we ask of you.
Transport security
- All API traffic is encrypted over TLS 1.2+. Plain HTTP connections are rejected.
- The API enforces HSTS with a long max-age to prevent downgrade attacks.
- Internal service-to-service communication is also fully encrypted via mutual TLS.
API key security
- Lumen Sieve stores a one-way hash of your API key, never the raw value. Even Lumen Sieve engineers cannot read your key.
- Keys have a structural prefix (
lumen_test_sk_/lumen_live_sk_) so they can be detected by secret-scanning tools like GitHub's secret scanner. - Revoked keys are rejected within 60 seconds — faster than most OAuth token TTLs.
- Enterprise plan and above can restrict keys to an IP allowlist. Requests from unlisted IPs return
403 IP_NOT_ALLOWEDeven with a valid key.
Tip: Enable secret scanning in your GitHub / GitLab organisation. Lumen Sieve's key format is registered so pushes that accidentally include a key are caught automatically.
Data encryption at rest
- All customer data is encrypted at rest using AES-256.
- Database backups are encrypted with a separate, rotated key.
- Encryption keys are managed via a dedicated key management service with hardware security module (HSM) backing.
Data retention
| Data type | Retention | Notes |
|---|---|---|
Generated profiles | 12 months from last access | Extended on the Enterprise plan |
Request logs | 90 days | Covers all API calls, excluding request bodies |
Account data | Until account deletion | Export available on request |
Note: You can request full deletion of your account data at any time by emailing privacy@lumen.com. Deletion is processed within 30 days in compliance with GDPR Article 17.
Compliance
| Standard / regulation | Status |
|---|---|
GDPR (EU) | Compliant — DPA available on request |
CCPA (California) | Compliant |
SOC 2 Type II | In progress — report available under NDA |
ISO 27001 | Planned (2026) |
Responsible disclosure
If you discover a security vulnerability in Lumen Sieve, please report it responsibly before public disclosure. We commit to:
- Acknowledge your report within 2 business days.
- Provide a status update within 7 business days.
- Resolve critical vulnerabilities within 30 days.
- Credit you in our release notes (unless you prefer anonymity).
Report a vulnerability
Email security@lumen.com with a description, reproduction steps, and your contact details. Please encrypt sensitive details using our PGP key.
In-scope: Lumen Sieve API, dashboard, authentication systems. Out-of-scope: third-party infrastructure, social engineering, physical attacks.