Data retention policy
Lumen5 retains data while the Customer continues to be a Customer.
Once a Customer ceases to be a customer, the following steps are completed:
1. Customer is sent a notice via email of change of standing and given the option
to reinstate the account.
2. If no notice is received to #1 above within 30 days, or if Customer responds
that they do not wish to reinstate their account, the Customer is given a
chance to remove their data from our systems.
3. If Customer submits a request for deletion at any time, Lumen5 removes the
data from Lumen5 systems and Customer is sent notice of removal of data.
Data archiving and removal policy
Lumen5 will delete a customer's data when they cease to be a customer and request the deletion of their data.
On physical devices, Lumen5’s hosting provider will dispose of the hardware in a
secure fashion. When such devices are decommissioned, they are purged or destroyed
according to NIST 800-88 Guidelines for Media Sanitation.
As according to our privacy policy, a copy of the de-identified dataset may be kept for
Lumen5 usage. De-identification data must remove all personal identifiers from the
dataset.
Data storage policy
Production Data Security
Guidelines for security of production data:
1. Implement and/or review controls designed to protect Production Data from
improper alteration or destruction.
2. Ensure that confidential data is stored in a manner that supports user access
logs and automated monitoring for potential security incidents.
3. Ensure Lumen5 Customer Production Data is segmented and is only accessible
to Customer authorized to access data.
4. All Production Data at rest is stored on encrypted volumes.
Encryption and Cryptographic Keys
1. All data transmissions and data-at-rest should be encrypted. Plaintext or
unencrypted communications should never be used for customer data.
2. Cryptographic keys should be signed by a reputable certificate authority.
3. Any private (non-public) keys must be protected with security measures at
least as stringent as the measures used for distribution of that key.
4. The loss, theft, or potential unauthorized disclosure of any encryption key must
be reported immediately to the Security Officer.
Transmission Security
1. All transmitted data is encrypted end-to-end. Encryption is not terminated at
the network endpoint and is carried through to the application.
2. All traffic from clients must be forced through HTTPS (Hypertext Transfer
Protocol Secure) to ensure the security of data in transit. The connection is
encrypted at a minimum of 256-bit encryption using TLS 1.3.
3. Transmission encryption keys are limited to use for one year and then must be
regenerated.
Data Segregation
Data from all environments should be segregated to ensure security. Production data
should be segregated from test, staging, and internal data through logical and
infrastructure controls.
Data hosting company
Google Cloud
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
no