Security Policy

Every row that belongs to a person is protected at the database level by row-level security, so a query can only return that person’s data even if the code asking for it is wrong. Every request that changes something also checks ownership explicitly, so neither of those two things is the only thing standing between two accounts.

A website written by a model is untrusted output. In the editor it runs inside a sandboxed frame with no access to Lumen’s cookies or page. Published, it runs under a strict content security policy: no scripts but its own, no framing by other sites, no form posting off to anywhere else. The visual editor never lets the browser author markup — it names a section and the server decides what that becomes.

• API keys and connector tokens are encrypted before they are stored, and decrypted only to make the request they are for.
• Passwords are handled by our authentication provider and never reach us.
• Card details never reach us at all — payments are handled by the payment provider.
• Errors have keys, bearer tokens and JSON web tokens stripped out before they are written to a log.

Administrative access is limited to the people who run Lumen and is used for operating the service — investigating a fault, answering a support request. We do not read customer projects for any other reason.

Requests that cost money or send mail are rate limited per account and per address. Public forms carry a hidden field no person fills in, which stops most automated submissions without putting a puzzle in front of a real customer.

Lumen is a young product. We do not hold ISO 27001 or SOC 2, we do not run a formal penetration testing programme yet, and we do not offer a service level guarantee. If you need those, say so before you build something important on it, and we will tell you honestly where we are.

If data is exposed, we will investigate, stop it, tell the people affected and the relevant authority without undue delay, and say what we found. To report a vulnerability, see Responsible Disclosure; for anything else security-related, write to socialsprouts1@gmail.com.