Six defence layers, a four-link isolation chain, and the numbers behind them — each line dated, and each line stamped with where the proof lives: in our code, or in the platform accounts that front it. Your clients’ brands, voices and faces live in this system; this page is the inspection record.
Two numbers on the old version of this page were wrong. We checked, corrected them, and logged it.
Security contact — security@luminarworks.com · answered by the people who build it
Verifiable in the codebase. The mechanism exists as reviewable source — middleware, migrations, services — and the claim was re-checked against it on the review date.
Configured in the platform accounts — Cloudflare, Render, Supabase. Real, reviewed on the stamp date, but not visible in source code — so we say so instead of blurring the two.
A request crosses six layers between the internet and a client’s data. Each line below is a real mechanism with a review date — not a diagram of intentions.
Agencies run many clients in one account. The isolation model is the product’s spine: a bug in application code cannot leak data between clients, because the last link is enforced by the database, not by us remembering to check.
Your agency’s account — the billing and plan boundary. Every JWT carries its tenant claim.
One workspace per client. Brand assets, voice, knowledge base, people and products are workspace-scoped — never pooled.
Owner → Admin → Multi-Account Manager → Member → Viewer. Every request re-checks the caller’s role in middleware.
Postgres RLS filters by tenant and workspace at the database level. The query returns the row or it doesn’t exist.
The order matters: by the time a query reaches the data, three layers have already said yes — and the fourth doesn’t take the application’s word for it.
Full data export on demand — streamed archive, API keys redacted, link delivered by email. Account deletion with a 72-hour grace period and one-click cancel, then a cascade across 34 tables in FK-safe order plus the storage buckets. Ready means built, not aspirational — and we don’t claim a certification we don’t hold.
Paddle is our Merchant of Record — payments, VAT, sales tax and regional regimes are collected and remitted by Paddle as an independent controller. Card numbers never touch our systems.
25 audited action types across 7 groups — auth, roles, workspaces, settings, API keys, billing, admin — captured to a dual-persistence trail: structured logs plus an append-only audit table the application cannot rewrite.
Logs scrub email addresses, JWTs, API keys, webhook secrets and bearer tokens before they leave the process. PII never reaches error telemetry; transaction tracing samples at 10%.
Concurrent pipeline runs per tenant — fair scheduling; no tenant can starve another.
Alert rules with cooldown windows — circuit-breaker trips, 5xx error spikes and RLS violations page a human.
Error events captured — every exception reaches telemetry, scrubbed first.
PII leaves the server un-scrubbed — redaction runs in the logger and the telemetry layer both.
Every upstream AI provider sits behind a circuit breaker — a provider outage fails over, queues, or returns a clean error · numbers re-checked against source 05 Jul 26
The AI Imagery feature can put a real person — a client’s founder, a team member — into generated scenes. That deserves more than a marketing line, so here is exactly how consent, storage and deletion work.
A person cannot be added without an explicit consent confirmation — the create request is rejected without it, and the system records who confirmed and when, permanently attached to the person’s record. Said plainly: it is an auditable record of the confirmation, not a stored legal release. The agency remains responsible for holding the person’s actual permission; the platform makes the moment auditable.
Two levels. Pause stops the person appearing in any future generation but keeps their record so previously created artwork still resolves. Delete (admin-level) removes the person’s record and their reference photos from both the database and file storage. Individual photos can also be deleted one at a time.
They are stored workspace-scoped under row-level security — no other client, and no other tenant, can reach them. At generation time, reference photos are transmitted to the AI image provider to render the scene, under provider terms that exclude training on customer content. We won’t say “they never leave” — that would be false. They leave for exactly one purpose, and they are not kept.
People who have given the agency their permission — that is what the consent confirmation asks you to affirm, per person, before any photo is accepted. Five reference photos per person, angle-slotted, capped. We test the feature on our own founder’s face — the standard is: comfortable enough to use it on ourselves.
The sheet is signed
Bring this page to your security review — or write to security@luminarworks.com and ask the awkward questions directly. The answers come from the people who wrote the middleware.
No card · No trial countdown · No per-client fees