Our posture, stated plainly, including what we have not done yet. Last updated 4 August 2026.
Tenant-owned records carry an organization scope enforced in the data layer, and cross-tenant isolation is covered by automated tests that attempt to cross the boundary on every change. Managed service providers get a further tenant layer built and tested the same way, per client.
Passwords are stored using Django's PBKDF2 hashing. LumaTrack-issued API keys are shown once at creation and stored as salted hashes; a revoked key is rejected from the moment revocation is saved. Provider admin keys you add for spend import are encrypted at rest, not hashed, because we must send them to that provider on your behalf; remove them any time. Production traffic runs over TLS.
Closed months are frozen: the API, the app, imports, and the staff admin all refuse writes into a closed period, and late evidence books as a labeled correction instead of rewriting history. Reported figures trace to stored run events, over-cap events are held and visible rather than discarded, and a nightly integrity job re-derives open figures and checksums frozen periods. These controls are enforced in code and covered by the test suite.
We are a young product and will not pretend otherwise: no SOC 2 report yet (controls are being built with that audit in mind), no SSO/MFA yet (on the roadmap for Business and Enterprise tiers), single-region hosting. If your security review needs specifics, ask: support@lumatrack.io, and you will get straight answers.
Email security@lumatrack.io. We acknowledge within 2 business days, we do not pursue good-faith researchers, and we credit fixes if you want credit.