Live Mode: BYOC Engine for KYC/AML Evaluation

Some compliance workloads are too sensitive to leave your network. When KYC/AML evaluation must run under regulatory data-residency rules or a zero-trust posture, Lumis Live Mode (bring-your-own-container) lets you run the compliance engine on your own hosts while keeping the workflow, versioning, and auditability of the sandbox.

When to Self-Host

Most teams start with the hosted sandbox and move to Live Mode when:

• Data Residency: Regulators require that certain transaction data never leaves your region — or your premises.
• Zero-Trust Networks: Your security team requires that only your controlled infrastructure touches production data.
• Latency-Sensitive Pipelines: The engine runs in-network next to the systems that produce the payloads.

Live Mode is available on Pro, Business, and Enterprise plans.

Architecture: Customer-Hosted Data Plane

Live Mode splits the control plane from the data plane:

• Control Plane (Lumis): Your workspace holds the source-of-truth ruleset bundle. On sync, Lumis compiles the ruleset and signs it with Ed25519.
• Data Plane (Your Container): Your container runs the Lumis Rust engine. It polls the control plane, verifies the bundle's Ed25519 signature, and serves evaluations from the cached, verified bundle.
• Live payloads never enter Lumis infrastructure. Payloads sent to /evaluate are evaluated in memory on your hosts and never transmitted to Lumis.

+---------------------+   sync (signed bundle)   +--------------------------+
| Lumis control plane | -----------------------> |  Your container          |
| (workspace, bundle, | <----------------------- |  Lumis Rust engine       |
|  quota metering)    |   heartbeat (counts)     |  Ed25519-verified bundle |
+---------------------+                          +--------------------------+
                                                          |
                                            POST /evaluate (in-network)
                                                          |
                                                   Transaction data
                                                   (never leaves)

The 72-Hour Grace Scenario

The engine keeps serving from its cached bundle for up to 72 hours if the control plane becomes unreachable. This grace window absorbs transient network or maintenance outages without interrupting evaluation.

Beyond the grace window, or if the license is revoked (a 401 response to sync or heartbeat), the engine stops with a hard stop: /evaluate returns 403 {"error":"license_revoked"}. Grace is a safety valve, not a license bypass.

The Telemetry Boundary

The engine reports only counters. The heartbeat body is exactly two numbers:

{ "evaluations_count": 17, "period_seconds": 300 }

No rule names, no payload fragments, no stack traces, no URLs. The count is applied to your monthly simulation quota, so Live Mode reuse the same metering you already rely on.

Deployment Checklist

1. Generate a workspace engine API key under Settings → API Keys.
2. Generate an Ed25519 signing seed (openssl rand -hex 32).
3. Set LUMIS_ENGINE_SIGNING_KEY on the control plane and derive LUMIS_ENGINE_PUBKEY from it.
4. Run the container with LUMIS_API_KEY, LUMIS_ENGINE_PUBKEY, and the control-plane URL.
5. Confirm GET /health returns ok, then verify GET /pubkey returns your expected public key.

Compliance Benefits

• Reduce liability surface: Live payloads stay in your network, so fewer copies of sensitive data exist outside your control. May reduce liability — it never removes your statutory duties.
• Non-repudiable audit records: Every evaluation carries an Ed25519 seal, so results can be verified cryptographically.
• Prove the same rules everywhere: The identical bundle that runs in the sandbox runs in your container — verified by signature, not by trust.