Security & Compliance

When you generate an API key in Settings, the raw key (prefixed lmk_live_) is shown exactly once. Lumis immediately hashes it with SHA-256 and discards the plaintext. Only the hash is stored.

When you make an API call, your client computes the same hash of the raw key and sends the hash in the request. The backend looks up the hash in the database — no plaintext comparison ever happens.

1. Client sends POST /simulate with Bearer Token "lmk_live_abc123"
2. Edge gateway computes SHA-256 hash of "lmk_live_abc123"
3. System performs a constant-time lookup against stored hashes
4. If matched, the simulation executes; plaintext is never logged or stored

When PII Masking is enabled in Settings → General, Lumis applies regex-based redaction to the payload string before writing it to the audit trail. The in-memory payload used for DAG evaluation is never masked — only the stored copy.

PII masking is opt-in and applies globally to all simulations in your workspace. Enable it under Settings → General.

Every data access request must first pass through our identity and tenant resolution middleware. This ensures that queries and mutations are strongly bound to the authenticated workspace. Data is only returned if the ownership exactly matches the caller's identity.

Middleware Pipeline:
1. Extract Bearer Token or Session Cookie
2. Resolve caller identity (User ID & Tenant ID)
3. Inject Tenant ID into the current execution context
4. Automatically append "WHERE workspaceId = Tenant ID" to all reads/writes
5. Reject request with 403 FORBIDDEN on any tenant mismatch

Rulesets created by your workspace carry a strict tenant association. If a caller attempts to access a resource from a different workspace, the operation is blocked before execution begins.

Lumis uses a robust token-bucket algorithm at the edge to protect the simulation engine. Each workspace has its own bucket. The default configuration:

When the bucket is empty, further calls throw RATE_LIMITED. Back off and retry after approximately 1 second per token needed.

Every simulation writes an immutable record to the secure audit log:

• ›Transaction ID (globally unique)
• ›Workspace and ruleset IDs
• ›Final status (passed / failed / error)
• ›Ordered audit trail of every node evaluation
• ›Stored payload (PII-redacted if masking is enabled)
• ›Creation timestamp

Audit records are retained for 7 days (Free), 90 days (Pro), or 1 year (Business). Records are never mutated after creation.

To verify Lumis audit logs and ensure absolute data integrity and non-repudiation, the platform employs a daily batch cryptographic sealing process that builds a continuous SHA-256 hash-chain over the simulation log ledger. If a log is deleted, inserted, or modified after the daily seal is generated, validation will immediately fail.

Method A: API Verification

You can programmatically verify any simulation run by making a secure GET request to the audit API. This is ideal for automated tooling, CI/CD gates, or programmatic compliance workflows.

curl -X GET "https://lumiscompliance.com/api/audits/[simulation_id]" \
  -H "Authorization: Bearer <your_api_key>"

{
  "timestamp": "2026-05-23T19:56:15Z",
  "audit": {
    "simulation_id": "kx78t9h4k1p9...",
    "ruleset_id": "r_us_patriot_act_v1",
    "execution_status": "passed",
    "steps_executed": 3,
    "integrity": {
      "verified": true,
      "method": "sha256-cryptographic-hash"
    }
  }
}

Method B: Visual Portal Verification (Auditors & Regulators)

Lumis provides a public-facing, zero-auth Verification Portal designed specifically for third-party auditors and regulators who do not have a Lumis account.

• ›Simulation ID verification: Paste the globally unique Simulation ID from the report header directly into the validation input.
• ›File drop verification: Drag and drop any exported CSV, HTML, or JSON audit log directly into the drop zone. The portal automatically extracts the Simulation ID from the file metadata and runs the integrity check.

Method C: In-Console Verification (Workspace Members)

Logged-in workspace members can verify transaction authenticity directly from their Execution Logs dashboard without leaving the console:

• ›Direct Authenticity Inspection: In the Execution Logs page, click any simulation row to slide open the detail drawer.
• ›Real-Time Verification: Navigate to the Verification tab. The system will automatically execute an in-place cryptographic seal verification against the immutable ledger and display the seal timestamp, ID, and tamper-free status.

If you discover a security vulnerability, please report it responsibly via email to security@lumiscompliance.com. Do not disclose publicly until we have had a chance to investigate and issue a patch. We aim to respond within 48 hours.