Security

1. Infrastructure security

• Cloud-hosted on Microsoft Azure

  All production workloads run on Microsoft Azure in isolated resource groups with network security groups restricting inbound and outbound traffic.

• Azure Front Door with WAF

  Public traffic passes through Azure Front Door with a Web Application Firewall (WAF) in prevention mode, providing protection against OWASP Top 10 vulnerabilities and DDoS attacks.

• Container-based deployments

  Services run as hardened container images in Azure Container Apps. Images are built from minimal base images and scanned for known vulnerabilities before deployment.

• Network segmentation

  Production, staging, and development environments are fully isolated. Internal services communicate over private virtual networks and are not publicly accessible.

2. Data protection

• Encryption in transit

  All data transmitted between your browser and our Services is encrypted using TLS 1.2 or higher. We enforce HTTPS and reject insecure connections.

• Encryption at rest

  Data stored in our databases and blob storage is encrypted at rest using AES-256, managed by Azure Storage Service Encryption.

• Data isolation

  Each customer's data is logically isolated. We enforce strict data access boundaries to ensure one customer cannot access another's data.

• Minimal data collection

  We collect only the personal data necessary to provide our Services. For a full list of data we collect, see our Privacy Policy.

3. Access controls

• Role-based access control (RBAC)

  Access to the platform is governed by roles. Administrators can configure fine-grained permissions for each user within their organisation.

• Principle of least privilege

  Our internal staff are granted access to production systems only to the extent required for their role. Access is reviewed regularly.

• Audit logging

  All privileged access to production infrastructure is logged. Logs are retained for 90 days and monitored for anomalous activity.

4. Authentication

Authentication on the Luminar Works platform is managed by a self-hosted Keycloak identity provider, providing:

• Industry-standard OpenID Connect (OIDC) and OAuth 2.0 protocols.
• Support for multi-factor authentication (MFA) — strongly recommended for all users.
• Session management with configurable token lifetimes and automatic expiry.
• Brute-force protection with account lockout after repeated failed login attempts.
• Single Sign-On (SSO) support for enterprise customers.

Passwords are never stored in plaintext. Keycloak stores credentials as salted hashes using industry-standard algorithms.

5. Monitoring and incident response

We operate continuous monitoring across our infrastructure and application layers:

• Automated alerting on anomalous activity, error spikes, and infrastructure health metrics.
• Security log aggregation and retention for 90 days.
• Defined incident response procedures with assigned ownership and escalation paths.
• Regular reviews of access logs and permission assignments.

In the event of a data breach that affects your personal data, we will notify affected customers by email to the address registered on their account. Where required by law, we will also notify the relevant supervisory authority (GDPR: within 72 hours of becoming aware; POPIA: as soon as reasonably possible after discovery).

6. Responsible disclosure

We welcome reports from security researchers and the community. If you believe you have discovered a security vulnerability in our Services, please report it to us responsibly:

We ask that you:

• Do not access, modify, or delete any data that does not belong to you.
• Do not disclose the vulnerability publicly before we have had a reasonable opportunity to address it.
• Do not perform denial-of-service attacks or any testing that could impact service availability.

We will not pursue legal action against researchers who act in good faith and follow these guidelines.

7. Contact our security team

For security enquiries, vulnerability reports, or questions about our security practices, contact us:

For personal data and privacy concerns, please contact our Information Officer at privacy@luminarworks.com or review our Privacy Policy.