Security
Security and data handling at Lumora
Each Lumora customer runs its own deployment of the product it buys, on one agreed environment. This page explains where your data is stored, who can sign in and see it, how AI features handle it and how to get your security questions answered.
- 01Your own deployment
- 02One agreed environment
- 03AI proposes, people confirm
Where is my data stored when I use Lumora?
Your data is stored in the deployment of the Lumora application you bought, on one agreed hosting environment. That environment is either managed by Lumora, with hosting included, or your own hosting, using application files Lumora provides. Either way, your records live in your deployment and are not pooled with other customers' data.
If you host the application yourself, your team controls the servers, the network and who can reach them. If Lumora manages the environment, our team runs it and can help with technical questions about the application.
Ask us where a Lumora-managed environment would run and how it is set up before you decide. See the two deployment options.
Access
Who can sign in and what they can see
Access controls are built into each product and differ between them. These are documented for the products named; ask us about the product you are considering.
- 01
Roles and permissions in Lumora AcademyPro
Default and custom roles, staff assigned to specific centres, and a permission check on the server for every page and action.
- 02
Sign-in protection in Lumora AcademyPro
Two-factor sign-in with an authenticator app, passkeys, Google and Microsoft sign-in limited to allowed email domains, and lockout after repeated wrong passwords.
- 03
Workspace roles in Lumora Clockit
Owner, admin, manager and member roles in each workspace. All data belongs to a workspace, and recordings are private by default.
- 04
Single sign-on in Lumora Clockit
SAML 2.0 and OIDC single sign-on on verified domains, with SCIM 2.0 to create, update and remove users from your identity provider.
Records
What is logged and protected
These controls are documented for the products named.
- 01
Tamper-evident audit log in Lumora AcademyPro
Each audit entry is linked to the one before it by a hash, and the chain is checked every day.
- 02
Activity log in Lumora Clockit
A searchable record of activity with user, IP address and browser, which can be exported or streamed to Splunk, Datadog or a JSON endpoint.
- 03
Encrypted sensitive fields
Lumora AcademyPro encrypts items such as staff bank account numbers, KYC tokens and webhook secrets in the database. Lumora Clockit stores OAuth tokens, provider credentials and SSO secrets encrypted.
- 04
Backups and retention
Lumora AcademyPro takes daily database backups with a weekly completeness check. Lumora Clockit deletes old recordings and synced email after a retention period the workspace sets.
How do Lumora AI features handle my data?
Lumora AI features send the text they need to Anthropic Claude or OpenAI through an API key; in Lumora AcademyPro that is the academy's own key. The AI drafts or suggests, and a person reviews and confirms before any record changes. AI features are optional where a product offers them, and you can ask our team what each one sends.
Lumora Clockit runs its AI features on one platform-level key that its administrator sets. Because AI requests go to an outside provider, that provider's terms apply to the text it receives. Our team can tell you which provider and model a product uses. See AI features by product.
Security reviews
Ask us your security questions
Security reviews differ between organizations. Send us your questionnaire or list of requirements and our team will answer it for the product and deployment you are considering. Ask our team about your compliance requirements.
- Where the deployment will run and who manages it
- Who can reach the application and the server
- Which outside services the product connects to
- How backups and data retention work
Questions
Questions about security
Have a security review to complete?
Tell us which product you are considering and how you would like to deploy it. We will answer your questions for that setup.