Trust Center

Security, privacy & trust at AskLumo

Last verified: September 2026 · Build: 2026-09-30

Everything your procurement and security teams need in one place. AskLumo is the AI brain for your business systems: it reads your systems' metadata and records (always within your permissions) to answer questions, review access, and analyze reports. It never changes anything on its own: any change to Salesforce is explicitly initiated and approved by an authorized user, previewed, and audited. AskLumo is hard-isolated per tenant and contractually barred from training any AI model on your data.

No autonomous writes

Every change is human-approved & audited

Enforced

Tenant-isolated

Per-tenant process + storage, scoped in code

Enforced

Zero-training

Anthropic contractually barred

Guaranteed

Zero-inbound

Private VPC, no public ingress

Enforced

Compliance posture

Where AskLumo stands today, stated honestly. Several controls are inherited from our infrastructure subprocessors, and our own SOC 2 is planned for 2026.

SOC 2

Planned for 2026

CloudPrism's own report planned for 2026. Infrastructure is already SOC 2 Type II via AWS, Anthropic & Salesforce.

GDPR

Supported

Deletion on request; DPA available

ISO 27001

Inherited (AWS)

Underlying infrastructure

AWS FSBP

Active

200+ continuous controls in Security Hub

How AskLumo connects & handles data

The architecture your security team will want to understand, in plain terms.

Reads within your permission ceiling

AskLumo reads your Salesforce metadata and records to answer questions, review access, and analyze reports. Every read runs as your integration user, so its Field-Level Security is the hard limit on what AskLumo can ever see. It never changes anything on its own.

Per-tenant isolation

Each customer runs on a dedicated application process, a tenant-scoped S3 prefix, and DynamoDB access scoped to your tenant ID in code. Cross-tenant reads are blocked by design and deployment layout. Shared authentication tables hold only session and user records, not your org data.

Changes are governed, never autonomous

The AI never writes on its own. Any change to Salesforce is initiated and approved by an authorized user, previewed before it is applied, and written to an audit log. Metadata build and deploy (where AskLumo generates and deploys Apex, objects, fields and flows) runs against a Salesforce sandbox org and is available only to users granted developer access.

Production is never a deploy target. Builds run against a sandbox you own.

Role-based access

Access is role-based. Viewers are strictly read-only; only users granted developer access can run the build & deploy pipeline; and any change still passes through an explicit approval step. Not everyone with a login can make changes.

No AI training on your data

Our model provider (Anthropic) is contractually barred from using your data to train models. Only the question text and the relevant metadata excerpt for that question are sent for inference. Zero-Data-Retention is available on request.

Encryption everywhere

TLS 1.2+ in transit end to end. At rest: S3 with SSE-AES256, DynamoDB and EBS encrypted, and secrets in SSM SecureString under a customer-managed KMS key with automatic 365-day rotation.

Private network, zero inbound

AskLumo runs in a private VPC subnet with no public IP and zero inbound security-group rules, so no external entity can initiate a connection. Egress exits a NAT Gateway with a fixed, allowlistable IP.

Systems we connect to

System What AskLumo reads Notes
Salesforce Metadata (objects, fields, flows, validation rules, reports) and records within your integration user's permission ceiling Read-only via JWT Bearer; FLS enforced; your Connected App

Security controls

Continuously applied across our AWS infrastructure and processes.

Reads run within FLS ceiling
No autonomous writes
Role-based access (admin / BA / developer / explorer / viewer)
Human-approved changes only
Sandbox-only metadata deploys
Full change audit log
Hard tenant isolation
JWT Bearer auth
Least-privilege integration user
GuardDuty threat detection
Security Hub (AFSBP)
Inspector v2 CVE scanning
IAM Access Analyzer
Multi-region CloudTrail
DynamoDB PITR (35-day)
KMS-managed secrets
IMDSv2 enforced
Session Manager only (no SSH)
MFA & root-login alarms
VPC endpoint isolation
Retention & TTL deletion
Incident response (1 biz day)
Customer-managed KMS on all object storage and tables
Immutable container tags with continuous CVE scanning
Read-only container root filesystem, non-root user
Multi-region CloudTrail with log-file validation, 7-year retention
Point-in-time recovery and deletion protection on all tables

Subprocessors

The third parties that help deliver AskLumo, and what they process. All hosted data stays in AWS us-east-2 (Ohio); other regions on request.

Subprocessor Role & data shared Compliance
Amazon Web Services All hosted infrastructure (EC2, S3, DynamoDB, SSM, CloudWatch, GuardDuty, KMS) SOC 1/2/3, ISO 27001/27017/27018, PCI DSS, FedRAMP
Anthropic Model inference; question text + relevant metadata excerpt only SOC 2 Type II · no training · ZDR on request
Salesforce Your own tenant, accessed via a customer-owned integration user Your existing Salesforce posture
Slack Outbound notifications only; no record data forwarded Your existing Slack posture
Jira (Atlassian) Request titles, descriptions and status sync Your existing Atlassian posture

Frequently asked questions

The questions security and procurement teams ask most, answered from our real architecture.

Can another customer read our data? ⟩
No. Each customer runs on a dedicated application process, a tenant-scoped S3 prefix, and DynamoDB access scoped to your tenant ID in code. Cross-tenant reads are blocked by design and by the deployment layout. Shared authentication tables hold only session and user records, not org data.
Can AskLumo write to or change our Salesforce org? ⟩
Not on its own. The AI never writes autonomously. Any change is explicitly initiated and approved by an authorized user, previewed before it is applied, and written to an audit log. The metadata build and deploy pipeline (where AskLumo generates and deploys Apex, objects, fields and flows) runs against a Salesforce sandbox org, keeps a human in the loop, and is available only to users granted developer access. Read-only users have no ability to make changes.
Who can make changes, and who can only read? ⟩
Access is role-based. Viewers are strictly read-only. Only users granted developer access can run the build & deploy pipeline, and even then every change passes through an explicit human approval step and is logged. Not everyone with a login can change your org.
Can AskLumo read fields a user is not allowed to see? ⟩
No. Backend reads execute as a dedicated, least-privilege integration user via OAuth 2.0 JWT Bearer. That integration user's profile and Field-Level Security, which you own and control, is the hard ceiling on every field AskLumo can access.
Do you train AI models on our data? ⟩
No. Anthropic is contractually barred from using your data to train models. Only the question text and the relevant metadata excerpt for that question are sent for inference. Zero-Data-Retention is available on request.
Where is our data stored, and for how long? ⟩
All hosted data stays in AWS us-east-2 (Ohio); other regions on request. Application events are retained 90 days, read-audit events 1 year (both TTL-enforced), metadata until you request deletion, and application logs 30 days. Tenant deletion is honored within 5 business days of written request.
How is data encrypted? ⟩
TLS 1.2+ in transit end to end. At rest: S3 with SSE-AES256, DynamoDB and EBS encrypted, and secrets in SSM Parameter Store as SecureStrings under a customer-managed KMS key with automatic 365-day rotation.
Can a CloudPrism engineer access our data? ⟩
Operator access is via AWS Systems Manager Session Manager only; no open SSH port, no long-lived keys. Every privileged AWS API call is logged in multi-region CloudTrail. Console logins without MFA and any IAM change raise alarms.
Could prompt injection exfiltrate our data? ⟩
AskLumo does not expose a general HTTP or shell tool to the model. Egress is limited to Anthropic (inference), Salesforce (via your own Connected App), and Slack (outbound notifications only, with no record data forwarded), so there is no open channel for a model to send data anywhere else.
How does the Chrome extension authenticate? ⟩
It borrows the user's existing Salesforce session — no separate login, no stored credentials. It is read-only and never writes to the org.
What can you provide for our vendor review? ⟩
On request: a full Security Overview, a completed SIG Lite or CAIQ, CloudTrail and tenant audit-log exports for any window, an AWS Security Hub findings export, a signed MNDA or DPA, and Anthropic's DPA / ZDR confirmation.

Security package

The posture on this page is public. Detailed materials, including our full Security Overview and architecture & data-flow diagram, are shared with your security team on request under NDA. We respond within one business day.

Prefer email? Reach our security team directly at security@asklumo.io.