English
Deutsch
Español
Français
Italiano
Certifications
- ISO 27001 certified
- All data hosting solutions (provided by Microsoft Azure) are fully compliant with ISO 27001. Luminovo has been ISO 27001 certified since June 2023.
- ITAR-registered
- Luminovo, Inc. is registered with the U.S. Directorate of Defense Trade Controls (DDTC) and supports ITAR-compliant workflows for defense and aerospace customers.
- SOC 2 compliant
- Our hosting infrastructure, provided by Microsoft Azure, is fully SOC 2 Type II compliant.
- GDPR-compliant
- We adhere to GDPR requirements and maintain full compliance as standard.
Hosting and encryption
- Flexible hosting
- Choose between hosting in Frankfurt, Germany, or Virginia, USA. Powered by Microsoft Azure, with Azure Government available for regulated workloads.
- Encryption in-transit and at-rest
- All data is encrypted at rest using FIPS 140-2 validated cryptographic modules and the AES 256-bit cipher. For transport layer security, we use TLS 1.2+ everywhere.
- Multi-tenant security
- With a multi-tenant architecture our software ensures data separation of different customers on a database level
- Backups and disaster recovery
- We do automatic instantaneous backups and keep the backups in zone-redundant storage for 14 days.
- DDoS protection
- Access to our servers is protected from denial-of-service attacks using Cloudflare’s always-on DDoS protection.
Access control
- Strong password policies
- A strong password policy (disallowing the 10,000 most common passwords; disallowing personal data – like the name – and enforcing minimum length, special characters, lower- and uppercase characters, and numbers in any password) make it difficult, if not improbable, for someone to guess a password through either manual or automated means.
- Multi-factor authentication
- We offer the option to secure your logins with multi-factor authentication.
- Single Sign-On (SSO) and SAML
- Available on Enterprise plans for secure, streamlined authentication.
- Role-based access control
- Define user and admin roles for customized access permissions.
- Suspicious IP throttling
- We automatically protect against suspicious logins targeting too many accounts from a single IP address.
Subprocessors
Yes, personal data is shared with subprocessor tools. Among other things, we use these tools to ensure a great user experience and to help continuously improve our products.
| Subprocessor | Purpose | Address |
|---|---|---|
| Amplitude Inc. | Product AnalyticsProcessing and evaluation of usage data o analyse and optimize software functionality and improve the user experience | 201 3rd Street, Suite 200San Francisco, CA 94103, United States |
| Auth0, Inc. | Identity ManagementAuthorisation and authentication of users | 100 First Street, Floor 6San Francisco, CA 94105, United States |
| Cloudflare, Inc. | Operation of the backend for the MCP interface and the apps, and of an isolated execution environment (sandbox) for automatically generated code | 101 Townsend Street, San Francisco, CA 94107, United States |
| HelpHero (Cloudling Ltd.) | OnboardingProduct tours to introduce the user to the product and to new functions | Cloudling Limited, 4 Kapanui Street,Warkworth 0910, New Zealand |
| Honeycomb | Observability & DebuggingLogging of observability data to identify and fix performance problems of the product | 548 Market St #25362San Francisco, CA 94104, United States |
| Intercom, Inc. | Customer Support ChatCustomer communication and support based on contextual usage data and user-provided communication content. | 55 2nd Street, Suite 400San Francisco, CA 94105, United States |
| Userlens | Adoption AnalyticsCollection and evaluation of usage and product analytics data to support product adoption, enhance usability and product design. | Lapinlahdenkatu 1600180 Helsinki, Finland |
| MagicBell | Notification CenterSending notifications in the Software | Magic Bell, Inc.2261 Market Street #4311 San Francisco, CA 94114 United States |
| Microsoft Deutschland GmbH | Cloud Hosting & DatabaseStorage of personal data and documents (via Azure Blob Storage and Azure Database for PostgreSQL) | Microsoft Deutschland GmbH, Friedrich-Ebert-Anlage 49,60308 Frankfurt, Germany |
| Segment.io, Inc. | Data RoutingSecure routing of user metrics and product analytics data to evaluate and improve the product | Twilio Inc.101 Spear St FL 5San Francisco, CA 94105, United States |
| SendGrid (Twilio Inc.) | Transactional EmailsSending automated email notifications triggered by software events. | Twilio Inc.101 Spear St FL 5San Francisco, CA 94105, United States |
| Sentry (Functional Software Inc.) | Error TrackingIdentification, monitoring, and alert of errors, bugs, and other performance issues in the software to improve the product | Functional Software Inc.45 Fremont Street, 8th FloorSan Francisco, CA 94105, United States |
| Stripe, Inc. | Payments (Customer Portal)Payment processing provider | 354 Oyster Point BlvdSouth San Francisco, CA 94080, United States |
| Vercel Inc | Cloud platform for hosting and deploying web applicationshosts web application and delivers it to users’ browsers, may therefore process personal data contained in requests made by users accessing the application | 201 Mission Street, Suite 300, San Francisco, CA 94105 |
As listed in Annex 2 of the Luminovo GmbH data processing agreement, version October 23, 2026. Luminovo, Inc. lists its subprocessors in Annex 2 of its own agreement.
Responsible disclosure
- Bug Bounty
- We reward reports of relevant, confirmed security vulnerabilities sent to security@luminovo.com.
- Vulnerability protection
- We use an automated security scanner on every code change to uncover any known vulnerabilities and misconfigurations in our software.
- Information security officer
- Our founder and managing director Timon Ruban serves as information security officer, supported by our dedicated security team.
Documents
Frequently asked questions
How is my data secured?
Data security is a priority. Luminovo is ISO 27001 certified, employs encryption, adheres to GDPR, and offers features like secure logins and role-based access control to keep your information safe.
How long do you store my data?
Luminovo deletes personal data after 30 days unless otherwise defined by law. Exceptions are data such as names and e-mail addresses which will be deleted at the end of the contract period. Deletion happens automatically in the relevant tools of our subprocessors. If no automatic deletion functionality is available, Luminovo’s Product Intelligence unit deletes personal data manually. For more in-depth information, please contact us at security@luminovo.com.
Do you share personal data with subprocessors?
Yes, personal data is shared with subprocessor tools. Among other things, we use these tools to ensure a great user experience and to help continuously improve our products.
Please find a list of the tools and the reason why we use them here
Which cookies does your website collect?
Which cookies does your software collect?
Which are your technical and organizational measures (TOMs)?
How do you ensure effective security monitoring and responding to incidents?
For example, we use software such as Honeycomb to monitor our systems. We also have defined change management procedures to control and document changes to the software in order to minimize security risks.
We collect, store and analyze log data in accordance with the requirements of our ISO 27001 certification. Our Incident Response Plan, which is also part of this certification, includes clearly defined steps for detecting, reporting and responding to security incidents.
In addition, we conduct regular vulnerability scans and offer a bug bounty program. We reward relevant, confirmed security vulnerabilities reported to security@luminovo.com to help identify and fix potential threats early.
What happens in case of a personal data breach?
In the event of a data breach, we immediately conduct an investigation and notify the relevant stakeholders. This ensures swift, effective, and comprehensive measures are taken to mitigate any potential impact.
