Lumen, Secure by Design

At a glance

Updated 12 Oct 2026

Where it runs

Your own servers

Models, documents, and answers stay on hardware you control. Your firm’s own cloud account is an option.

Every action

Logged inside your network

Chats, tool calls, agent runs, and admin changes go to the Compliance Portal, on your servers.

Who sees what

Your sign-in, your roles

Staff sign in through your directory. Active Directory, Google, Microsoft, SAML, or Okta.

Encryption

In transit and at rest

TLS 1.2 and 1.3 in transit. As an option, your content is encrypted under a key in your own key service, which we never hold.

Sealed Mode

An install option for Lumen that closes every outside connection.

Search, chat, agents, and meeting notes keep working on your own servers and your own files. Cloud models, web search, and cloud apps stay off, and updates are loaded by hand.

It also fits a network with no internet at all.

Install summary

Sealed ModeNo connections outside your network

Cloud modelsOff
Web searchOff
Cloud apps (SharePoint Online, Slack, Jira)Off
Online updatesOff · loaded by hand
File shares and on-network appsOn
Your directory sign-inOn

Concept drawing, not a screenshot.

Every outside connection Lumen can make

A core install needs no internet. Here is each connection Lumen can make, and how to turn it off.

Connection	When it happens	What goes out	How to turn it off
Cloud models	Never. Lumen runs local models by default and never uses cloud models.	Nothing	Off by default
Web search	When a person or an agent runs a web search. Each search is logged.	Search words the AI writes from the conversation, then plain requests to the result pages. Searches can run through any search API, including DuckDuckGo’s privacy-focused search.	Turn off web tools in Admin
Connected apps	When you connect SharePoint, Google Drive, Box, Confluence, Slack, Jira, or Microsoft 365	Lumen reads your content with each person’s own sign-in. Agents post or send only after a person approves.	Disconnect the app
Tool servers	When someone adds a third-party tool server	The tool request, over HTTPS. Each one waits for a person to approve it.	Add none
Sign-in	Each time someone signs in	An identity check with your sign-in provider	Use your on-network directory
Updates	When an update is installed: by your IT team, over the internet, or by our staff if you ask	Nothing, other than a check to see if an update is available	Load the packages by hand
Support and licensing	Lumen runs no license or usage checks.	Health metrics you agree to share, so our team can watch your deployment without signing in to Lumen	Share none. You set how involved we are.
Email	When Lumen sends a notice, an invite, or a password reset	That message, through the mail service you choose	Leave email unset
Your security tools	When you set up a feed to your SIEM or monitoring	Signed batches of audit events, or performance data, sent only to systems you name	Leave them unset

How Lumen is checked

What we test, and what your security team can review.

Passed
Prompt injection, our own test
We hid an instruction in a sample procedure. Lumen summarized the procedure, then flagged and ignored the hidden line.
September 2026 · Read the test
Every release
Signed packages
Each update is a signed package your IT team checks and installs on its own schedule.
On request
Your security team
Under NDA: our architecture document, CISO whitepaper, and answers to your security questionnaire.

Access follows your rules

Lumen connects to your identity system and uses the roles you already have. People see answers only from documents they can already open. Sign in with Active Directory, Google, Microsoft, SAML, or Okta.

A log your examiners can search

Every chat, tool call, agent run, approval, meeting, consent, export, and admin change is logged in the Compliance Portal, inside your environment. Search by person, date, keyword, or type, and include deleted items. Deleted chats are kept for 30 days by default, or as long as you set.

Updates on your schedule

Each release is scanned for known vulnerabilities, checked for risky dependencies, and reviewed before it ships. Updates arrive as signed packages that your IT team checks and installs when it is ready.

Questions from your review

Send us your security questionnaire, and we will answer it. Common questions get their answers added to this page. Under NDA we share our architecture document, our CISO whitepaper, and anything else your review needs.

Report a problem

Found a security issue? Tell us before you publish it, and give us a fair window to fix it. Our contact is in security.txt. We will reply and tell you what we plan to do.