Lumière Agents › Security

How we protect your data

Lumière Agents emails your customers in your name, so it holds your invoices, quotes and contacts. Here's how that data is kept safe. Have a security questionnaire? Send it to hello@lumierepaycheck.org and we'll answer it.

Your data is kept apart from everyone else's

• Every customer's data sits behind database row-level security that is forced on: a query that forgets which business it's for returns nothing instead of another business's data.
• In a multi-location company, each location is its own account with the same separation; head office sees locations only through logins it has been given.

Encryption

• All traffic uses HTTPS (HSTS on), and the database and backups are encrypted at rest by our hosting provider.
• Connection tokens (QuickBooks, Microsoft, Google), API keys and uploaded documents are additionally encrypted with a per-business key, itself wrapped by a master key kept outside the database.

Signing in

• No passwords to leak: people sign in with a one-time link or 6-digit code sent to their email, valid 15 minutes. Codes lock after 5 wrong tries.
• Enterprise companies can sign in with single sign-on instead (Google Workspace, Microsoft Entra ID or Okta and other OpenID Connect providers), and turn email sign-in off for their domain.
• Sessions are HttpOnly cookies protected against cross-site requests; each person can choose to be signed out after a period of inactivity and sign out other devices.
• Roles per location: owners, approvers (send and edit emails) and viewers (read only).

You stay in control of what's sent

• Every agent starts in approve-each-email mode; automatic sending is a switch the owner turns on per agent.
• Accounting connections are read-only: we read invoices, quotes and customer emails and never write to QuickBooks.
• Daily sending limits per location, per-customer weekly limits, business-hours-only sending, and one-click unsubscribe in every email.

Audit and exports

• An append-only activity log records who approved, edited or sent what, and when (without email bodies).
• Owners can download their activity log as CSV and all of their data as a file at any time; at the end of a contract we delete the account and everything in it.

Who processes data for us

• Render (hosting and database, US), Resend (sending and receiving email), Stripe (payments), Anthropic and OpenAI (AI reading and writing, only when AI is on; not used to train their models under their API terms), Twilio (texting, on your own account), and Intuit, Microsoft and Google (only when you connect them).

Reporting a problem

Found a security issue? Email hello@lumierepaycheck.org or open a private security advisory on GitHub. We reply within two business days and won't take action against good-faith research. See also security.txt and our privacy policy.

Live status, uptime and support response times: status page.

We don't currently hold a SOC 2 report.