Trust Center
Welcome to Lumara Health's Trust Center. Lumara Health builds AI-assisted workflow software for health plans and other healthcare organizations. Production instances of our platform run inside each customer's own environment, so customer data, including protected health information, stays under the customer's control; Lumara Health acts as a HIPAA business associate under a Business Associate Agreement. This trust center describes how we protect data, the policies we operate under, and the sub-processors we use. Security questions and incident reports: security@lumara.health. Privacy requests: privacy@lumara.health.
Product Security
Lumara Core runs inside each customer's environment. It writes an audit trail of every model call and user action, encrypts data in transit and at rest, and keeps decisions in reviewable rules rather than in the model.
Reports
Architecture and data-flow documentation is available under an access request. Our HIPAA attestation is public in the Documents section.
Data Security
Data is classified in four tiers. Protected health information is Restricted and is never stored on Lumara-hosted systems; customer data stays in the customer's environment.
App Security
Lumara-hosted applications are scanned at least quarterly. Findings are tracked to resolution under our Vulnerability Management Policy. Report suspected vulnerabilities to security@lumara.health.
AI
We use third-party large language models through their APIs, bounded to language understanding and phrasing. A deterministic rules engine owns decisions. Customer data is never used to train models.
Data Privacy
We act as a HIPAA business associate for customer data and as the controller only for the limited personal data we collect directly. Our Privacy Statement is at lumara.health/privacy. Requests: privacy@lumara.health.
Access Control
Named accounts, least privilege and multi-factor authentication on every system that supports it. Access is reviewed quarterly and revoked within one business day of separation.
Infrastructure
Lumara-hosted systems run on Vercel, Neon and Supabase in US regions, with the providers' managed security. Production instances of Lumara Core run in the customer's environment.
Endpoint Security
All work is performed on company-owned Macs enrolled in device management, with full-disk encryption, automatic screen lock and automatic updates enforced.
Network Security
Lumara Health operates no network of its own. Every system is a managed platform reached over TLS with multi-factor authentication where supported; there is no VPN or SSH because there are no self-managed hosts.
Corporate Security
A published Code of Conduct and policy set acknowledged by all personnel, email authentication (SPF, DKIM, DMARC), and an inventory of every device and system.
Policies
Twenty-six information security and privacy policies are published and acknowledged by all personnel. Request access to read them.
Incident Response
An Emergency Response Team triages reports within one business day, immediately for suspected major incidents. Affected customers are notified within 72 hours of confirmation. Report to security@lumara.health.
Risk Management
An enterprise security risk assessment is performed at least annually and on material change. Vendors are risk-tiered, assessed before engagement and reviewed annually.
Asset Management
Every device and system is inventoried with an owner, classification and risk tier; devices are tracked through Apple Business Manager and MDM and erased before reuse.
BC/DR
Business continuity and disaster recovery plans with 24-hour recovery time and recovery point objectives, tested at least annually. The last restore test was in September 2026.
Training
Security awareness and HIPAA training for all personnel at onboarding and annually, with secure-coding training for engineering roles.
Change Management
Every production change goes through peer review and automated build, type and test checks before merge.
Continuous Monitoring
Controls are monitored continuously in Drata against our identity, code and device-management platforms.