Skip to content

Legal

Security

Effective 31 October 2026. This page describes how we protect our website at lumienzo.com and our app at app.lumienzo.com, including the accounts people create and the Instagram accounts creators connect. It lists only what is operating today. Questions or reports go to team@lumienzo.com.

How the app is protected

  • Encrypted in transit and at rest. The website, the app and its API are served only over HTTPS. The app runs on Google Cloud in the United States, which encrypts our database and stored files at rest.
  • Instagram access tokens. A creator's Instagram token is encrypted with AES-256-GCM before it is stored, with keys we can rotate without disconnecting anyone. It is never returned to a browser or an API response, and our logs redact tokens automatically.
  • Instagram access the creator controls. Creators connect through Instagram Login, Meta's official connection, and approve access on Instagram's own page. We read, and we change nothing on a creator's Instagram on our own: a comment, a reply, changing or deleting their own, or hiding or showing a comment happens only when they or their team press the button for it, and we use what we receive from Instagram only as our Privacy Policy describes and as the Meta Platform Terms and Developer Policies allow.
  • Email or Google only. You come in with your email address or your Google account through our identity provider, Clerk. Sessions use short-lived access tokens and single-use refresh tokens that are stored only as hashes, and a refresh token used twice ends that whole session.
  • Every request is checked. Each request is authenticated, rate limited, and authorized against your own account and your membership of the workspace it touches, so one workspace cannot read or change another's data.
  • Safe file handling. Uploaded files are identified by their actual contents, not their names, and stored under random unguessable names.
  • Careful with links people give us. When Lumi reads a website someone gave us, our servers refuse private and internal network addresses, check every redirect, and cap how long and how much they read.
  • Least privilege. Our production servers run with only the cloud permissions they need, and our engineers work with short-lived credentials rather than permanent keys.
  • An append-only record. Account access and sensitive actions, such as deleting an account, are recorded in an append-only log.
  • Deletion that actually deletes. Deleting an account removes it in a single step that either completes fully or not at all, and removing Lumienzo from Instagram deletes everything we received from Instagram.

How the website is protected

  • HTTPS everywhere. HSTS is enabled (max-age of two years, includeSubDomains, and preload) so browsers refuse to connect over plain HTTP.
  • Strict security headers. We serve a strict Content-Security-Policy locked to our own origin plus a small number of named sources, along with X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Referrer-Policy: strict-origin-when-cross-origin.
  • Locked-down browser permissions. Our Permissions-Policy disables geolocation, microphone, and camera, and opts out of FLoC cohort tracking.
  • No tracking. We set no analytics or advertising cookies and run no ad pixels or cross-site trackers. Visit statistics come from Cloudflare Web Analytics, which uses no cookies and does not fingerprint visitors.

Compliance

We are honest about certifications: we hold none today, and we will not claim any we have not earned.

  • SOC 2. We are not SOC 2 certified. SOC 2 Type II is in progress, and we are building our controls with that framework in mind.
  • Privacy rights. We support data-subject rights under GDPR, UK GDPR, and CCPA, including access, correction, and deletion. Our Privacy Policy sets out the lawful bases we rely on, our international transfer safeguards, and exactly how we handle connected Instagram accounts.
  • Data Processing Agreement. A DPA is available on request. Contact team@lumienzo.com and we will provide it.

Reporting a vulnerability

If you believe you have found a security issue, please tell us at team@lumienzo.com. We are committed to acknowledging good-faith reports quickly and working with you in good faith to understand and fix the issue.

Safe harbor. We will not pursue or support legal action against researchers who make a good-faith effort to follow this policy: test only against your own data and accounts, avoid privacy violations and service disruption, and give us a reasonable chance to remediate. Please do not publicly disclose an issue before we have released a fix. We do not offer cash bounties, but we may recognize and thank researchers at our discretion.

Contact

Lumienzo, Inc. Reach us at team@lumienzo.com.