Security & Compliance

When you generate an API key in Settings, the raw key (prefixed lmk_live_) is shown exactly once. Lumis immediately hashes it with SHA-256 and discards the plaintext. Only the hash is stored.

Your client sends the raw key as a Bearer token over TLS. Lumis hashes it server-side and performs a constant-time lookup against stored hashes — the plaintext is never compared, logged, or retained.

1. Client sends POST /simulate with Bearer Token "lmk_live_abc123" (TLS)
2. Edge gateway hashes the token with SHA-256 server-side
3. System performs a constant-time lookup against stored hashes
4. If matched, the simulation executes; plaintext is never logged or stored

The Live Mode engine adds a per-crate cryptographic baseline. Rather than a single platform-wide hash, each protocol layer is signed with Ed25519:

• ›Ruleset bundles are Ed25519-signed by the control plane; the engine refuses to load unsigned bundles.
• ›Evaluation results are sealed with an Ed25519 signature (per-deployment key) for non-repudiable audit records.
• ›Telemetry boundary: the engine reports { evaluations_count, period_seconds } ONLY — no rule names, payload fragments, stack traces, or URLs.
• ›The engine keeps request bodies in memory only; it never logs or persists them, and live payloads never enter Lumis infrastructure.

If the control plane is unreachable, the engine serves from its cached bundle for up to 72 hours (grace). A 401 sync or heartbeat response revokes the license immediately — /evaluate then returns 403 { error: "license_revoked" }.

When PII Masking is enabled in Settings → General, Lumis applies regex-based redaction to the payload string before writing it to the audit trail. The in-memory payload used for DAG evaluation is never masked — only the stored copy.

PII masking is opt-in and applies globally to all simulations in your workspace. Enable it under Settings → General.

Every data access request must first pass through our identity and tenant resolution middleware. This ensures that queries and mutations are strongly bound to the authenticated workspace. Data is only returned if the ownership exactly matches the caller's identity.

Middleware Pipeline:
1. Extract Bearer Token or Session Cookie
2. Resolve caller identity (User ID & Tenant ID)
3. Inject Tenant ID into the current execution context
4. Automatically append "WHERE workspaceId = Tenant ID" to all reads/writes
5. Reject request with 403 FORBIDDEN on any tenant mismatch

Rulesets created by your workspace carry a strict tenant association. If a caller attempts to access a resource from a different workspace, the operation is blocked before execution begins.

Lumis uses a robust token-bucket algorithm at the edge to protect the simulation engine. Each workspace has its own bucket. The default configuration:

When the bucket is empty, further calls throw RATE_LIMITED. Back off and retry after approximately 1 second per token needed.

Every simulation writes an immutable record to the secure audit log:

• ›Transaction ID (globally unique)
• ›Workspace and ruleset IDs
• ›Final status (passed / failed / error)
• ›Ordered audit trail of every node evaluation
• ›Stored payload (PII-redacted if masking is enabled)
• ›Creation timestamp

Audit records are retained for 7 days (Free), 90 days (Pro), or 1 year (Business). Records are never mutated after creation.

To verify Lumis audit logs and ensure absolute data integrity and non-repudiation, the platform employs a daily batch cryptographic sealing process that builds a continuous SHA-256 hash-chain over the simulation log ledger. If a log is deleted, inserted, or modified after the daily seal is generated, validation will immediately fail.

Method A: API Verification

You can programmatically verify any simulation run by making a secure GET request to the audit API. This is ideal for automated tooling, CI/CD gates, or programmatic compliance workflows.

curl -X GET "https://lumiscompliance.com/api/audits/[simulation_id]" \
  -H "Authorization: Bearer <your_api_key>"

{
  "timestamp": "2026-05-23T19:56:15Z",
  "audit": {
    "simulation_id": "kx78t9h4k1p9...",
    "ruleset_id": "r_us_patriot_act_v1",
    "execution_status": "passed",
    "steps_executed": 3,
    "integrity": {
      "verified": true,
      "method": "sha256-cryptographic-hash"
    }
  }
}

Method B: Visual Portal Verification (Auditors & Regulators)

Lumis provides a public-facing, zero-auth Verification Portal designed specifically for third-party auditors and regulators who do not have a Lumis account.

• ›Simulation ID verification: Paste the globally unique Simulation ID from the report header directly into the validation input.
• ›File drop verification: Drag and drop any exported CSV, HTML, or JSON audit log directly into the drop zone. The portal automatically extracts the Simulation ID from the file metadata and runs the integrity check.

Method C: In-Console Verification (Workspace Members)

Logged-in workspace members can verify transaction authenticity directly from their Execution Logs dashboard without leaving the console:

• ›Direct Authenticity Inspection: In the Execution Logs page, click any simulation row to slide open the detail drawer.
• ›Real-Time Verification: Navigate to the Verification tab. The system will automatically execute an in-place cryptographic seal verification against the immutable ledger and display the seal timestamp, ID, and tamper-free status.

If you discover a security vulnerability, please report it responsibly via email to security@lumiscompliance.com. Do not disclose publicly until we have had a chance to investigate and issue a patch. We aim to respond within 48 hours.