LuxTrust
Trust, security and compliance.
How Lux protects your network data, the vendors that touch it, the papers your legal team will ask for, and how our agents stay in check.
Trust at Lux
Your network data, handled with care.
Lux agents work inside your network records. Here is what we protect, how, who else touches your data, and the documents your legal and procurement teams will ask for.
-
Your data stays yours
Network, field, subscriber and billing records are kept per organization and checked on every request.
-
People decide
Agents propose. Actions that leave your workspace wait for a person, until an owner or admin decides otherwise.
-
Every change on record
Role changes, autonomy settings and approvals go into an audit trail no one can edit.
Security controls
What protects your data today.
Each control below is built into the Lux app. Open one to see how it works.
-
Every page and every API call needs a signed-in session.
Sign-in runs on Clerk. Your organization can sign in through its own identity provider with SAML or OIDC single sign-on, and roles can be mapped from your directory. A refused attempt is recorded.
-
Every project request is scoped to your organization and checked.
Access to a project is granted by an explicit share or by membership in your organization. Anything else is refused. A dedicated database for your organization is available on request.
-
HTTPS everywhere, and encrypted storage underneath.
Browsers are told to use HTTPS only. Stored data is encrypted by our storage providers. Integration credentials and database passwords are sealed again by Lux with AES-256-GCM before they are stored.
-
API keys are shown once and stored only as a fingerprint.
Lux keeps a SHA-256 hash of each key, never the key itself. Each key carries its own scopes and can be revoked. A revoked key always fails.
-
Each person and each agent holds a seat with limits.
Built-in roles cover design, field, operations, billing and more, and you can add your own. Nobody grants themselves more, nobody grants more than they hold, and the last admin cannot be removed.
-
Every governed change is written down and chained.
Role grants, autonomy changes, data walls and approvals are recorded with who, what, before, after and when. Each entry carries the SHA-256 fingerprint of the one before it. No seat can edit or delete an entry, the admin's included.
-
Repeated failed sign-ins and key abuse raise alerts.
Security events go to one log. Bursts of failed sign-ins, credential spraying and rejected API keys are detected, and the API is rate limited. Error reports leave out personal details by default.
-
Dependencies, code and containers are checked before they ship.
Changes to the main branch are scanned on every pull request, and again every week, for known vulnerable dependencies, insecure code patterns and container issues. Dependency updates are proposed every week.
Subprocessors
Every vendor that touches your data.
These companies process customer data for Lux in production. Each one is named here with what it does and what it sees.
| Vendor | What it does for Lux | Data involved | Region | Vendor terms |
|---|---|---|---|---|
| VercelVercel Inc. | Hosts the Lux web app and its server functions. | All app traffic in transit: project data, prompts and account details, and server logs. | See vendor | DPA for Vercel |
| SupabaseSupabase Inc. | The main database: projects, network files, users and organizations, and live presence. | Project data, personal data and sealed integration credentials. | Set per database | DPA for Supabase |
| ClerkClerk Inc. | Sign-in, organizations, roles and single sign-on. | Names, email addresses, organization membership and sign-in details such as IP address and browser. | See vendor | DPA for Clerk |
| AnthropicAnthropic PBC | The AI models behind Lux agents. | Prompts, chat content and the project context the signed-in person may read. | United States | Trust center for Anthropic |
| RailwayRailway Corp. | Hosts Lux's own back-end services: solvers, the spatial engine, telemetry and the relay. | Project data sent for computation, and telemetry. | See vendor | DPA for Railway |
| Cloudflare R2Cloudflare Inc. | File storage for uploads and the data lake. | Uploaded files and datasets. | See vendor | DPA for Cloudflare R2 |
| UpstashUpstash Inc. | Cache and rate limiting. | Cached project file content and per-user request counters. | Set per database | Trust center for Upstash |
| E2BFoundryLabs Inc. | Isolated sandboxes where agents run code and solvers. | The project data used in that run. | See vendor | Website for E2B |
| MapboxMapbox Inc. | Maps, geocoding and routing. | Map requests, the addresses and coordinates searched, and IP address. | See vendor | DPA for Mapbox |
| SentryFunctional Software Inc. | Error and performance monitoring. | Error traces, request details and user ids. Personal details are left out by default. | United States | DPA for Sentry |
| StripeStripe Inc. | Plans, invoices and payments. | Billing contact, plan and invoice details. Card details stay with Stripe. | See vendor | DPA for Stripe |
| ResendResend Inc. | Email sent by Lux: notifications, messages and support replies. | Recipient email address and the message. | See vendor | DPA for Resend |
Showing all 12 vendors.
Integrations your organization connects itself, such as a CRM or a messaging account, process data under your own agreement with that vendor. Updated 14 October 2026.
Request the list as a PDFLegal documents
The papers your team will ask for.
Ask for them for your contract, security and AI reviews. Each one carries a version and a date.
- Data Processing AddendumRequest
How we process personal data for you, with security measures and subprocessors attached.
Version 1.0 · 14 October 2026 · PDF on request - Subprocessor ListRequest
Every vendor that processes customer data, what it does and what it sees.
Version 1.0 · 14 October 2026 · PDF on request - Acceptable Use PolicyRequest
What the platform and its agents may not be used for.
Version 1.0 · 14 October 2026 · PDF on request - Security OverviewRequest
The controls built into Lux, written for security and IT reviewers.
Version 1.0 · 14 October 2026 · PDF on request - Data Retention and DeletionRequest
Default retention periods, and how projects, people and organizations are deleted.
Version 1.0 · 14 October 2026 · PDF on request - Vulnerability Disclosure PolicyRequest
How to report a security issue and what we commit to.
Version 1.0 · 14 October 2026 · PDF on request - Responsible AI PolicyRequest
Who approves agent work, what is logged, and how your data is treated.
Version 1.0 · 14 October 2026 · PDF on request
Also on lux.tech
Responsible AI
Agents draft. People decide.
How an agent's work reaches the real world, and where your people stay in charge.
- The agent drafts
It works inside your project files. Every edit is versioned and can be undone.
- You see every step
Each message, tool call and result stays in the session, where you can read it back.
- A person approves
By default, filing, sending and spending wait for someone with the right role.
- It goes on the record
Approvals and setting changes join the audit trail nobody can edit.
Every agent action that reaches beyond your files starts off. An owner or admin can let one run on its own; some actions are person-only, and a machine never turns one on.
Lux does not use your data to train AI models. The one exception is a model your organization starts itself, from its own data.
An agent works under a role with limits and its own data reach, never above the person who set it up.
Report a vulnerability
Found a weakness? Tell us first.
Send it to
security@lux.tech
Include
- What you found, and where
- Steps to reproduce it
- What an attacker could do with it
- Whether you would like credit
What we commit to
- A person on our team reads every report.
- We confirm we have it and keep you updated until it is resolved.
- We credit you once the fix is out, if you want.
- No legal action over good-faith research within the policy.
What we ask
- Test only your own account and organization.
- Leave other people's data alone, and tell us if you reach it.
- No denial of service, spam or social engineering.
- Give us time to fix it before you go public.
Contact
Questions from your security or legal team?
Send them straight to our team.