Tenant-scoped access
Organization and verified-domain checks surround administrative records.
Enterprise security & data privacy
Controlled machine access. Clear security boundaries.
Lumeo gives AI agents structured access to approved business information without handing them direct database or ERP credentials. Requests are scoped, grounded, approval-controlled, freshness-aware, and verifiable.
This page states current product controls and configuration boundaries. It does not claim an external certification or absolute security.
Request boundary
Lumeo Gateway security path
Approved sources
Website · PDF · ERP · API
Controlled Gateway
Verify scopeResolve sourceApply policySign response
Agent response
Scoped · fresh · attributable
Control plane stays separate
Verified owners manage sources, clients, tools, policies, and approvals outside the public agent request path.
Protected credentials
Hashed client secrets and configurable AES-256-GCM source credentials.
Verifiable output
SHA-256 digests, freshness metadata, and optional Ed25519 signatures.
Bounded ingestion
Public-network validation, redirect checks, size limits, and injection exclusion.
Data access commitment
Your data remains yours.
Lumeo is designed to minimize unnecessary exposure—not to hide deployment boundaries behind an absolute “zero knowledge” claim. The controls below separate implemented product safeguards, operating commitments, and infrastructure choices.
Ownership and use
What Lumeo does with business data
No routine staff browsing
Access principleConnected business content is processed through service pipelines. Staff access should be limited to service operation, incident response, or an explicit support request under the customer’s deployment controls.
No Lumeo model training
Policy commitmentCustomer source content is not used to train a Lumeo general-purpose model. If a deployment uses a model or embedding provider, its region, retention, and training terms remain deployment-specific.
Tenant-scoped records
ImplementedGateways, sources, tools, clients, actions, and usage events are associated with an organization and verified domain. Administrative operations validate that scope before returning or changing records.
Encryption and access
How sensitive access is bounded
Source credentials
Configuration requiredAuthenticated-source credentials are stored separately and encrypted with AES-256-GCM when the required deployment key is configured.
Transport and storage
Deployment controlProduction transport security and object-storage encryption depend on the selected hosting, database, and storage providers and should be documented in the customer deployment record.
Secrets and client access
ImplementedAPI client secrets are revealed once, stored as hashes, and constrained by domain and operation scope. Signing keys remain outside source control.
No invented guarantees. Lumeo documents configuration-dependent encryption, storage, model-provider, and support-access terms in the applicable deployment and customer agreement.
Read the Privacy PolicyEight security pillars
Controls that follow the full request path.
Select a control to see how it works, what it protects, and where deployment configuration still matters. This register describes the current architecture; it is not a certification statement.
01ImplementedControl plane separationPublic agent traffic cannot use dashboard management routes.
How it works
The dashboard manages organizations, domains, sources, tools, and approvals. Public gateways expose only representations and actions explicitly enabled for a verified domain.
Protection boundary
Dashboard operations require an expiring session and organization role. Brain administration routes require a service credential when configured for production.
02ImplementedDomain and tenant verificationPublication starts with proof of domain control and scoped clients.
How it works
A business verifies ownership with a DNS TXT record or a well-known file before the Gateway is created.
Protection boundary
Organization checks surround administrative operations. API clients are restricted by allowed domain and operation scope, with secrets stored as hashes.
03Implemented + deployment controlSafe source ingestionOutbound fetching rejects internal networks and bounds every crawl.
How it works
Lumeo resolves each public source target before connection and repeats validation for every redirect.
Protection boundary
Private, loopback, reserved, and non-global addresses are blocked. Redirect count, response size, page count, and execution time are bounded. Production egress policy remains recommended against DNS rebinding.
04ImplementedGrounding and fact lineageAgent responses are tied to sources, freshness, and explicit unknowns.
How it works
Canonical records retain source identifiers, observed timestamps, confidence, and authority state.
Protection boundary
Unverified availability returns an explicit unknown state. Conflicting facts pause for owner resolution instead of being silently merged or invented.
05ImplementedHuman action controlConsequential requests can stop before execution for an owner decision.
How it works
Read operations can execute automatically when grounded and scoped. Write or financial operations can create an idempotent action record and return a pending status.
Protection boundary
The approval record keeps the requested input, status, approver, expiry, and execution result. Tool definitions should never contain unrestricted database credentials.
06Digest implemented · signing configuredCryptographic outputDigests expose body changes; optional signatures prove configured origin.
How it works
Every public Gateway response carries a SHA-256 Content-Digest and explicit freshness headers.
Protection boundary
When a deployment supplies a protected signing key and enables signing, Lumeo emits Ed25519 Signature and Signature-Input headers with a discoverable public JWK.
07Implemented · settlement configuredMetering and rate limitsMachine traffic is bounded before it becomes operational or financial risk.
How it works
Gateway limits are persisted in the shared database and evaluated by domain and requesting identity.
Protection boundary
Metering is owner-enabled. Included entitlements bypass charges; otherwise prepaid balances and HTTP 402 requirements apply, with reservations released after failed execution.
08ImplementedAudit and injection shieldsMachine activity remains reviewable and suspicious source text is excluded.
How it works
Tool usage records capture operation, client, status, latency, trace identifier, billed units, and execution outcome.
Protection boundary
Ingested chunks are scanned for instruction-like patterns. Flagged content is excluded from retrieval and replaced with an explicit security marker; records are durable, but not described as an immutable ledger.
Developer verification tool
Verify a Gateway response yourself.
Paste the exact response body and its integrity headers. The tool recomputes the SHA-256 digest, builds the signed response components, retrieves the public JWK, and verifies the Ed25519 signature in your browser.
Gateway signature verifier
RFC 9421-style sig1 · Ed25519 · SHA-256
Signing is optional and activates only when the domain and deployment have a protected signing key configured.
Open the standalone VerifierEnterprise assurance
Fit the deployment to your risk model.
Enterprise controls are confirmed through architecture review and documented in the applicable order form or DPA. Availability depends on scope, provider, and deployment model.
- Data Processing Agreements and deployment-specific data-flow review
- Dedicated or single-tenant infrastructure by customer agreement
- Tenant-specific encrypted credentials and signing keys; alternative custody by scoped architecture review
- Private-cloud or on-premises architecture review for qualified deployments
- SSO, role design, retention, regional hosting, and incident-process alignment
Responsible disclosure
Report a security issue privately.
Include the affected endpoint, reproduction conditions, and likely impact. Do not access data that is not yours, disrupt service, or publish a vulnerability before coordinated review.
Security contactsecurity@lumeoagent.comTarget response: acknowledge within 24 hours and begin triage within 72 hours. These are operating targets unless an agreement states otherwise.Encrypted disclosure
A public PGP fingerprint is not published until the corresponding key and rotation process are operationally verified. Request the current secure-reporting method by email.