Security

Built to be trusted.

Financial records deserve more than a promise. Here is exactly how we protect yours.

Encrypted. Always.

Your data is encrypted whenever it moves and wherever it rests.

In transit: TLS 1.2 or higher on every connection, with modern cipher suites only.
At rest: AES-256 encryption for databases, file storage and backups.
Keys: Managed in a dedicated key service and rotated every 90 days.

The right people see the right numbers, and you can prove it.

Two-step verification: Available on every plan and required for all Lumen Ledger staff.
Roles and permissions: Limit who can view, edit, approve or export, down to the report.
Audit log: Every sign-in and change is recorded with who, what and when.

A backup you have never restored is only a hope. We restore ours every quarter.

Continuous: Point-in-time recovery for the last 35 days, to the minute.
Separate regions: Encrypted copies are stored in a second geographic region.
Restore drills: A full restore is rehearsed and timed every quarter.

Your books are open whenever your business is.

99.99% target: Measured monthly across the application and the API.
Redundancy: No single server, zone or database is a single point of failure.
Open incident notes: When something goes wrong, we explain what happened and what changed.

We welcome reports from security researchers and treat every one seriously.

Email the details to our security team. Include steps to reproduce, and encrypt the message if you can.
We acknowledge your report within two business days and keep you updated as we investigate.
We fix confirmed issues quickly and tell you when the fix is live.
We will not take legal action against anyone who reports in good faith and avoids harming customer data.

Write to security@lumenledger.example. Our machine-readable policy lives in security.txt.

Our team will happily walk you through it.