SECURITY

Infrastructure

• Lumen is hosted on Railway, running on isolated containerised infrastructure in the US West (SFO) region.
• All data is stored on Supabase, hosted on AWS in the Mumbai (ap-south-1) region. Your data stays in India.
• Database encryption: all data is encrypted at rest using AES-256. All data in transit is encrypted using TLS 1.2 or higher.
• No direct database access from the application layer — all database operations are performed through the Supabase client with row-level security policies enforced at the database level.

Authentication

• Passwords are hashed using bcrypt with a cost factor of 12. We never store plain-text passwords.
• Google Sign-In is implemented via OAuth 2.0. We store only your Google ID and email address — never your Google password.
• Session management: authenticated sessions use HMAC-SHA256 signed cookies (HttpOnly, SameSite=Lax, Secure, 30-day expiry). Sessions cannot be forged without the server-side secret.
• All OAuth state tokens (used during platform connection flows) are signed with HMAC-SHA256. Forged or expired state tokens are rejected at the callback.
• Admin team members can enable two-factor authentication via TOTP.

Platform Integrations

• All platform connections (Shopify, Meta, Google, Razorpay, Shiprocket) are established via OAuth or API key, with credentials stored encrypted in the database.
• Lumen requests only the minimum scopes necessary for each integration. We never request write permissions unless a specific feature requires it — and currently all integrations are read-only.
• Each brand’s platform credentials are isolated at the database level. One brand cannot access another brand’s connected platforms under any circumstances.
• When you disconnect a platform, all stored credentials for that platform are deleted from our database immediately.

AI and Data Processing

• Your business data is sent to Anthropic’s Claude API to generate responses to your questions. This transmission is encrypted in transit.
• Anthropic’s API is used in a manner consistent with their usage policies. Your data is processed to generate responses and is not used to train AI models.
• We do not log the content of your questions or the AI’s responses in a way that is accessible to any party other than your account.
• Voice notes sent via WhatsApp are transcribed using OpenAI’s Whisper API. Audio is processed and discarded — we do not store audio files.

Payment Security

• All payments are processed by Razorpay. Lumen never stores, sees, or processes card numbers, CVVs, or banking credentials of any kind.
• Razorpay payment webhooks are verified using HMAC-SHA256 signature validation before any credits are applied to your account.

Access Control (Internal)

• Internal admin access to the Lumen platform is role-based. Team members are assigned minimum necessary permissions.
• All admin actions (plan changes, account modifications, team changes) are logged to an immutable audit trail.
• No Ocularity Analytics team member can access your business data (your Shopify orders, Meta campaigns, etc.) without an explicit impersonation action that is logged in the audit trail.

Responsible Disclosure

• If you discover a security vulnerability in Lumen, please report it to lumen@ocularityanalytics.com with the subject line "Security Disclosure".
• We will acknowledge your report within 48 hours and work with you to understand and resolve the issue.
• We ask that you do not publicly disclose any vulnerability until we have had the opportunity to investigate and address it.
• We are grateful to researchers who help us keep Lumen secure and will acknowledge your contribution if you wish.