Reward data is sensitive.
Here's exactly how we protect it.
We'd rather tell you plainly what we do — and where we're headed — than hide behind a logo. Below is the real picture, including what we don't yet have.
Encrypted in transit
All traffic to lumi is served over HTTPS/TLS. Your data is encrypted between your browser and our servers.
Hosted in the UK/EEA
lumi runs on established cloud infrastructure in the UK/EEA. Data residency and hosting are set out in our DPA.
Tenant isolation
Every organisation's data is logically separated. Members only ever see anonymised aggregates — never another organisation's raw answers.
Hardened accounts
Passwords are stored with bcrypt (never in plain text). Sessions are HttpOnly and SameSite; sign-in and password-reset are rate-limited against brute force, with tokenised, expiring reset and invite links.
Audit logging
Key actions are logged, so access and changes are traceable — the basis for accountability in any data-protection review.
Anonymity floor (n≥5)
Any figure resting on fewer than 5 organisations is suppressed everywhere — on screen, in exports, in board packs. No individual organisation's data can be reverse-engineered from the benchmark.
Handled under UK GDPR
Your data, your rights
- Used for one thing — the shared benchmark. Never sold, never passed to third parties for their own purposes.
- Data minimisation — lumi collects reward practice and policy answers, not individual employee records.
- Export any time, and request deletion — we delete your data within 30 days of a verified request.
- A Data Processing Agreement is available on request for members who need one.
Less to review, by design
- No HRIS integration and no data pulled from your systems — lumi is a guided questionnaire, so there's far less for IT and InfoSec to review.
- No individual employee data ever enters lumi — nothing personal to breach.
- Full sub-processor list published and kept current (below).
- Happy to complete your security questionnaire or DPIA — just ask.
Who touches your data
A short, current list — nothing more than we need to run the service.
The definitive list lives in our sub-processors page.
Certifications — the honest version
We don't yet hold SOC 2 or ISO 27001, and we won't claim a certification we don't have. Here's where we actually are, and where we're going. If you need something below sooner for a procurement process, tell us on the call — it helps us prioritise.
Questions your InfoSec team should ask?
Bring them to the demo, or email our data-protection contact directly — we'd rather answer plainly than send you a brochure.