Security & Trust
Lumo learns your brand, connects to your channels, and drafts your marketing, then waits for your yes. That's real trust to hold. Here's exactly how we protect your accounts, your content, and your data.
Last updated 21 July 2026
Encrypted end to end
TLS 1.2+ in transit, AES-256 at rest, across every draft, token, and asset.
Approval-gated
Nothing reaches your audience until a person signs off on it.
Least access
We request the narrowest channel permissions each platform allows.
Core controls
Foundational protections that apply to every account on Lumo, from your first connected channel onward.
Encryption everywhere
All traffic runs over TLS 1.2 or higher. Stored data, including drafts, media, and channel tokens, is encrypted at rest with AES-256.
Isolated channel tokens
OAuth tokens for your connected accounts live in an encrypted vault, scoped per workspace, and are never exposed to the browser or logs.
Google sign-in only
Authentication runs entirely through Google, so there are no passwords for us to store or leak. Your login inherits your Google account's own 2FA.
Full audit trail
Every draft, edit, approval, and publish is logged with a timestamp and an actor, so you always know what went out and who approved it.
AI, kept in bounds
No autonomous posting
Everything Lumo generates enters your queue as a draft. It cannot reach a live channel until an approver greenlights it.
Your content isn't training data
The brand playbook, prompts, and drafts inside your workspace are never used to train foundation models.
Scoped brand access
The model only sees the workspace it's generating for. It can't reach another brand's playbook, media, or channels.
How we operate
Hosted on SOC 2-compliant cloud providers with EU data residency. Production access is restricted, logged, and gated behind multi-factor authentication.
We request the minimum OAuth scopes each platform needs to schedule and publish. If a permission isn't required to do the job, we don't ask for it.
Disconnect any channel or delete your workspace at any time. On deletion, associated tokens and content are purged from active systems within 30 days.
Automated scanning watches our dependencies for known vulnerabilities, and patches are applied on a prioritized schedule.
Encrypted backups run on a regular cadence and are restore-tested, so an incident never means losing your work.
Data & access
What Lumo stores
Your drafts, scheduled posts, and published history
Media you upload to your library
Encrypted channel tokens used for scheduling
Your brand playbook and approval settings
Who has access
You and the teammates you invite to the workspace
Approvers you assign, scoped to their role
A limited set of Lumo staff, only for support you request
No advertisers, and we never sell or share your data
Status transparency
Every piece of content carries a clear status through its whole life, so nothing publishes by surprise.
Draft
In review
Scheduled
Published
A post advances only as a person approves each step. Published is the one state visible to your audience, and it's never reached without your yes.
Responsible disclosure