Platform · Security & compliance

Security you can check.
Not just believe.

Internal audit and supervisors want to see how a result came about. The platform shows it: the source for every value, the calculation path for every figure, the name behind every decision.

See your agent live

01Controls

Six commitments built into the product.

01Sourced
Every value carries its source: document, page, quote.
02Recomputable
Calculations with fixed formulas. The same inputs give the same result.
03Approved
Nothing changes and nothing leaves without a person's approval.
04Traceable
Who, when, what, with which source: logged so it cannot be altered.
05Permissions
The agent acts with the rights assigned to it.
06Operations
Hosted in Europe or in your own house. Your data separate from other customers.

02Principle

The AI reads. The software computes. Your team decides.

4.812.330

↳ JA_2025.pdf · p. 14, line 3

The AI reads.

For every figure you see where it comes from: document, page, quote. One click takes you there.

34,2 %

Equity / total assets · fixed formula

The software computes.

Fixed formulas, not AI. The same inputs give the same result. You see the calculation path for every value.

Approve

Name · time · reason in the audit trail

Your team decides.

Nothing changes and nothing leaves without approval. Who, when, what and why is written to the audit trail and cannot be altered.

03Regulation

What the platform maps to.

The table shows which platform function supports which requirement. It is a structural mapping. Your obligations stay with you; we provide the evidence for them.

Framework	Requirement	What the platform provides
EU AI Act	Art. 12 logging, Art. 13 transparency, Art. 14 human oversight	Audit trail per step, source for every value, approval points
EU AI Act	Annex III: creditworthiness assessment as high-risk	The vote stays with a person, complete credit file
DORA	ICT risk management, incidents, third parties	Registers, evidence and logs from operations
NIS2	Art. 21 risk-management measures	Access control, logging, supply-chain documentation
ISO 27001:2022	A.5.24, A.8.16, A.8.28	Incident data, monitoring, secure development
GDPR	Art. 25 data protection by design, Art. 32 security	Data minimisation, per-person permissions, separate tenants
FINMA 2023/1	Operational risk and resilience	Traceable processes, logs, operation in your infrastructure
§ 132 BAO (AT)	Seven-year retention	Unalterable storage of documents and history

04Data

What happens to your data.

Deployment & hosting

Is our data used for training?: No. No model is trained on your data.
Who sees our data?: Only people with rights in your tenant. The agent sees only what has been released to it.
Where is it stored?: In Europe or in your data centre, depending on the deployment variant.
How do we sign in?: Through your directory via single sign-on, with MFA and passkeys.

05 · Report a vulnerability

Found a weakness?

Write to security@lumesec.ai, encrypted with our PGP key if you like. We confirm receipt within one working day and publish after coordinated disclosure, at the latest after 90 days.

security@lumesec.ai Security policy →