What we enforce, and what we do not claim.

Threat model

Lumium assumes the operator's own infrastructure is trusted and model providers are semi-trusted. Provider output never acts on its own: a tool call is a proposal that the runtime executes through a typed, authorized tool, and the result is recorded against the run.

Two boundaries contain access. The organization is the tenant: it owns people, agents, models, capabilities, skills, connectors, channels, and secrets. The project is the work and authorization boundary: membership decides reads and writes, and an agent acts with the permissions of its project assignment rather than its owner's.

Secrets and storage

• Secret values are encrypted with AES-256-GCM using a key derived from the deployment's auth secret, stored with a per-record nonce.
• Secret values never enter prompts, tool results, logs, ledger payloads, or the interface; matched values are replaced with a redaction marker.
• Model and connector keys are references. They are unsealed inside the process that needs them and are never proxied through us.
• File content is content-addressed in the object store, with immutable revision records in the database.

Execution

• Agents reach project files and records through typed, authorized tools. No shell, host filesystem, browser, or remote-device command tool is exposed.
• Sessions hold leases with a waiting state, and terminal state is immutable once written.
• Conversation ownership is checked before a session is reused, and cleanup races are handled explicitly rather than assumed away.
• Agent-facing reads accept only bounded UTF-8 text and JSON, and identifier, path, and body sizes are bounded before they reach a model.

Records

Terminal run outcomes live in the run record, the authority operation, and the ledger. Ledger sequences are organization-wide, while entries carry optional project and conversation identifiers, so a question about one run and a question about the organization both resolve against the same evidence.

Compliance posture

There is no certificate to show yet. Lumium is in early access, and no audit report, attestation, or authorization package exists at this time. What exists is the deployment you run and the records it produces, both of which are open to review.

Responsible disclosure

If you believe you have found a security issue, please report it privately. We commit to:

• Acknowledging receipt within two business days.
• Providing a triage assessment within five business days.
• Crediting you in release notes, unless you prefer to stay anonymous.
• Not pursuing legal action against good-faith research.

Out of scope

• Volumetric denial of service or brute force against rate-limited surfaces.
• Attacks that require physical access to an unlocked machine.
• Issues in a model provider, which belong to that provider.
• Issues that affect only this marketing site.