Security at Luminate

Data protection & encryption

Customer and health data is encrypted in transit and at rest at all times.

• All network traffic is encrypted in transit using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256, with keys managed by AWS Key Management Service (KMS).
• Highly sensitive fields receive additional application-level (field-level) encryption before storage.

Infrastructure security

The platform runs on Amazon Web Services (AWS) in a hardened, network-isolated configuration.

• Databases and caches run in private subnets with no direct public exposure.
• Storage, databases, and backups are encrypted with KMS-managed keys.
• Access to infrastructure follows least-privilege principles and is logged.

Access control & authentication

Access to systems and data is restricted to authorized personnel and reviewed regularly.

• Administrative access uses single sign-on (SSO) with multi-factor authentication (MFA).
• Role-based access control enforces least-privilege for both staff and application users.
• Access rights are reviewed on a recurring basis and revoked promptly at offboarding.

Monitoring, logging & auditing

Activity across the platform is centrally logged, retained, and monitored.

• Application and infrastructure logs are centralized and retained for at least 365 days.
• Database activity is audited at the engine level for retrospective investigation.
• Automated vulnerability and dependency scanning runs continuously, with alerting on key security events.

Vulnerability management & responsible disclosure

We scan, triage, and remediate vulnerabilities on a defined cadence — and we welcome reports from the security community.

• Identified vulnerabilities are triaged by severity and remediated within defined service-level targets.
• If you believe you have found a security vulnerability, please email us with details and steps to reproduce.
• We will not pursue legal action against researchers acting in good faith who report issues responsibly and avoid privacy violations or service disruption. Please do not include real patient data (PHI) in any report.

Compliance

Luminate is built to meet the requirements of the healthcare environments it operates in.

• The platform is designed to support HIPAA compliance; a Business Associate Agreement (BAA) is available to covered entities.
• A SOC 2 (Security) examination is in progress; a report is available under NDA on request.
• Compliance controls are monitored on an ongoing basis.

Data privacy

How we handle personal and health information is described in our privacy policy.

• We collect and process only the data needed to deliver the service.
• See our privacy policy for details on data handling, retention, and your rights.

Read our privacy policy.