> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lume.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

## Compliance Standards

<Check>
  Lume is SOC 2 Type 1 and SOC 2 Type 2 Compliant.
</Check>

<Accordion title="What is SOC 2 Compliance?">
  SOC 2 is a compliance framework used to evaluate and validate an organization’s information security practices.
  It’s widely used in North America, particularly in the SaaS industry.
  Being SOC 2 Compliant means you have implemented the appropriate security controls and have had those controls investigated by a third-party auditor.
  Learn more [here](https://www.vanta.com/collection/soc-2/what-is-soc-2).
</Accordion>

## Lume's Security Principles

Lume is built on top of 5 principles, led by the SOC2 framework.

<CardGroup cols={2}>
  <Card title="Security" icon="people-arrows">
    The Security principle mandates comprehensive safeguards against unauthorized data access.
    It encompasses over 30 essential criteria, including stringent access control, robust physical security, and advanced encryption, ensuring data protection at all levels.
  </Card>

  <Card title="Availability" icon="people-arrows">
    The Availability principle ensures reliable data access for intended use by customers and staff, incorporating resilience and recovery capabilities for system disruptions.
  </Card>

  <Card title="Confidentiality" icon="people-arrows">
    Enhancing data protection, the Confidentiality principle focuses on safeguarding sensitive information, including trade secrets and personal data, from unauthorized exposure.
  </Card>

  <Card title="Processing integrity" icon="people-arrows">
    The Processing Integrity principle ensures the accuracy and reliability of customer data processing, crucial for entities managing data analytics or manipulation on behalf of clients.
  </Card>

  <Card title="Privacy" icon="people-arrows">
    Focusing on consumer data rights, the Privacy principle outlines criteria for protecting privacy and controlling data collection and usage.
  </Card>
</CardGroup>

# Security Highlights

Below is a preview of the controls and policies Lume has in place to ensure security.

### Infrastructure Security

<CardGroup cols={1}>
  <Card title="Least-Privilege Access">
    Restricts privileged access to infrastructure systems, such as databases, firewall, operating sytem, and production network only to authorized users with a business need.
  </Card>

  <Card title="Multi-Factor Authentication">
    The company's production systems can only be remotely accessed by authorized employees that

    * possess a valid multi-factor authentication (MFA) method.
    * have an approved encrypted connection
  </Card>

  <Card title="Firewall">
    The company uses firewalls and configures them to prevent unauthorized access.
  </Card>
</CardGroup>

### Organizational Security

<CardGroup cols={1}>
  <Card title="Employee Security Training">
    All employees at Lume are required to complete security awareness training within thirty days of hire and at least annually thereafter.
  </Card>
</CardGroup>

### Product Security

<CardGroup cols={1}>
  <Card title="Data Encryption">
    The company's datastores housing sensitive customer data are encrypted at rest.
  </Card>

  <Card title="Penetration Testing">
    The company's penetration testing is performed at least annually.
  </Card>

  <Card title="Data transmission encrypted">
    The company uses secure data transmission protocols to encrypt confidential and sensitive data when transmitted over public networks.
  </Card>
</CardGroup>

### Internal Security Procedures

<CardGroup cols={1}>
  <Card title="Vulnerabilities scanned and remediated">
    Host-based vulnerability scans are performed at least quarterly on all external-facing systems.
    Critical and high vulnerabilities are tracked to remediation.
  </Card>

  <Card title="Continuity and Disaster Recovery plans established">
    The company has a documented business continuity/disaster recovery (BC/DR) plan and tests it at least annually.
  </Card>
</CardGroup>

### Data and Privacy

<CardGroup cols={1}>
  <Card title="Data retention procedures established">
    The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.
  </Card>

  <Card title="Customer data deleted upon leaving">
    The company purges or removes customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the service.
  </Card>
</CardGroup>