Trust and security

• Every organisation is kept apart. Each organisation's records are separated in the database itself, by row-level security. A member of one organisation cannot read or change another organisation's resolutions, meetings, documents or messages.
• Sealed resolutions. When a resolution is ratified it is stamped with a fingerprint of its text. After that, the wording, the reference number and the signatures cannot be changed, not even by an administrator, and a ratified resolution cannot be deleted. Anyone holding the seal can check it on the public verification page.
• Signatures belong to the signer. A signature is added by the signed-in person, once. The name and role come from their profile, not from what the browser sends, and a resolution needs a majority of the organisation's members before it can become official.
• Locked minutes. Once a meeting's minutes are approved, the minutes, the agenda and the attendance list are locked and the meeting cannot be deleted.
• A record of who did what. Sign-ins, ratifications, minutes approvals and other sensitive actions are written to an audit log that can be added to but never edited or removed.
• Two-step sign-in. Any member can turn on two-step sign-in, and an organisation's administrators can require it for everyone.
• Sessions end when you step away. A session is closed after 15 minutes without activity.
• Controlled uploads. Files added to the vault are limited by type and size, and every upload is logged.

• Independent certification. Lumina does not yet hold ISO/IEC 27001 certification or a SOC 2 report. Both are audits of a company's practices over time, not features of the software, so they cannot be switched on. We plan to start with a SOC 2 Type I readiness assessment and will publish the result here when it exists. Until then we will not describe Lumina as certified or compliant.
• Single sign-on. Sign-in today is by email and password with optional two-step verification. SAML and OpenID Connect single sign-on for organisations that need it is planned as part of the paid organisation plan. The native apps deliberately do not offer sign-in through Google or Apple accounts.
• A published security review. We have not yet published the results of an independent penetration test.

Your organisation owns its records. You can delete your account from within the app or on the account deletion page. How we handle personal data is described in the privacy policy.

If you believe you have found a security problem, write to proacta@yahoo.com with the details. We will acknowledge your message and will not take action against anyone who reports a problem in good faith.