Security & trust
Your content, your accounts, your data.
This page describes what Lumen actually does today — no badges we have not earned. Last reviewed: 27 October 2026 (platform version 0.4.4).
Data isolation
Lumen is multi-tenant. Every record carries a tenant_id and every query is scoped by it; a tenant cannot read another tenant's posts, assets, conversations, platform credentials or audit data. Cross-tenant access was explicitly tested during our October 2026 security review (no working cross-tenant read or write was found).
Data lives in a per-deployment SQLite database (write-ahead logging, foreign keys on) on an isolated host. Uploaded media is stored per workspace with plan-based storage caps.
Authentication & access
- Passwords are stored as bcrypt hashes — never in plain text.
- Sessions use an HMAC-SHA256 signed, HttpOnly cookie with a server-side secret that must be at least 32 bytes in production (the app refuses to start otherwise).
- Roles: owner, admin, editor, viewer, reviewer and approver, enforced on the server for every route — not just hidden in the UI.
- Admin console routes require a separately flagged super-admin account.
- Sessions are invalidated when a password is rotated.
Publishing safety
- Two-step approvals — content can require a reviewer and an approver before it is publishable, with a full audit trail of every action.
- Content moderation runs before publishing and is re-checked at publish time; flagged posts are blocked.
- Autonomous publishing is opt-in per deployment — the AI Autopilot can generate and schedule content while publishing stays gated until explicitly enabled, and can be restricted to specific workspaces.
- Evergreen recycling re-enters review — recycled copies are never published without the same workflow checks.
Integrations & subprocessors
| Service | Purpose | Data shared |
|---|
| Meta (Facebook / Instagram) | Publishing and analytics | Post content, page/account identifiers, engagement metrics |
| LinkedIn, X, TikTok, Threads, Bluesky | Publishing (where connected) | Post content and account identifiers |
| WordPress site (customer-owned) | Blog publishing | Post content via application password |
| AI providers (OpenAI, Anthropic, Google Gemini, MiniMax, Xiaomi MiMo, or a customer-supplied endpoint) | Text, image and translation generation | Prompts and the business context you provide — only to the provider configured for your workspace |
| Email (Ivy Digitals mail infrastructure) | Transactional notifications | Recipient address and notification content |
API credentials for connected social accounts are stored per workspace and are never returned to non-admin members of that workspace.
Your rights
- Export — posts, analytics, assets and audit data can be exported from the app (CSV / XLSX / PDF / ZIP).
- Deletion — deleting a workspace removes its records; media files are removed from storage.
- Disconnecting an account removes the stored credential for that platform.
What we do not claim: Lumen is not SOC 2 or ISO 27001 certified, and we do not currently publish a formal uptime SLA. Enterprise agreements can include a bespoke SLA — talk to us.
Report a vulnerability
Email lumen@ivydigitals.com with steps to reproduce. We acknowledge within two business days and will credit reporters who ask to be named.