You hold your clients’ keys. We treat them that way.
An agency platform ends up holding the most sensitive things a client owns: their site, their CRM, their phone number and their logins. These are the controls that protect them — all shipped, none aspirational.
What is in place today.
Grouped the way an auditor asks about them. Every item below corresponds to something running in production, not a roadmap entry.
Identity & sign-in
- Email + password with argon2 hashing, or invite-only Google SSO
- Magic-link sign-in for users who should never hold a password
- TOTP two-factor and WebAuthn passkeys, including for the vault
- Signed session tokens with a per-user version counter for instant mass revocation
- Rate limiting on every authentication path
Access control
- Role model from platform owner down to per-location viewer
- A permission matrix with reusable packs and per-user overrides
- Location scope enforced server-side on every request, not just hidden in the UI
- An access explorer that shows exactly why a user can reach something
- Client portals run on expiring capability tokens with no session attached
Data protection
- Client credentials, TOTP seeds and API keys encrypted at rest under per-agency keys
- Mailbox bodies encrypted with a per-agency data key
- Analytics beacons hash visitor IPs before storage and set no cookies
- Vault reads are audited individually, with attachments and health state tracked
- One-click GDPR export and account deletion paths
Tenant isolation
- Agency → client → brand → location hierarchy enforced at the query layer
- Cross-tenant reads require explicit agency membership, checked on every gate
- Per-agency credential overrides so one tenant never uses another tenant’s keys
- White-label branding, domains and notification channels resolved per group
Infrastructure
- Cloudflare WAF in front, authenticated origin pulls behind — the origin refuses direct traffic
- TLS everywhere with automated certificate renewal
- Security headers, CSP reporting and strict transport security at the edge
- Application processes bind to localhost only; the database is never internet-facing
- Error tracking and structured audit logging across both tiers
Availability & recovery
- Blue/green deploys with an automatic rollback when the health check fails
- Database migrations applied before the cutover, aborting the deploy if they fail
- Off-site encrypted backups with restore drills and a retention window
- A public status page plus internal health, performance and incident tracking
- Spend caps and circuit breakers so a runaway integration degrades instead of billing
What we do not claim.
A trust page is only useful if it is accurate, so here is the boundary.
LunOS does not currently advertise SOC 2, ISO 27001 or PCI attestation. If you need one for procurement, ask — we will tell you where things stand rather than point at a badge.
Payments are handled by the payment provider’s hosted flow. LunOS stores the result of a charge, not the card.
Search, CRM and analytics data is pulled with your own credentials under your own account terms. Revoking a connection stops the sync.
The models that touch your data are listed on the integrations page, routed per action, and each call is logged with its cost.
Reporting a vulnerability
Email [email protected] with steps to reproduce. We will confirm receipt, keep you updated while it is being fixed, and credit you if you would like the credit. Please do not run automated scans against production or access data that is not yours while testing.