Data in Germany
Lumo runs on our own server in Germany. The database is encrypted at rest. We do not sell data and show no ads.
Security concept
Security is built in, not added later
This is how we protect your server, your team and your data. Every new feature follows these rules from the first line of code.
Encryption everywhere
Every connection uses HTTPS. Access tokens for your smart home are stored encrypted, passwords of share links and keys of devices only as hashes we cannot turn back.
Permissions that fit
Ranks with 23 single permissions, extra or fewer rights per person, private notes that not even admins can read. Every change lands in the audit log.
AI with a safety catch
Lumo AI only acts with the rights of the person asking. Anything that switches lights, controls a PC or runs a command is shown as a button and runs only after a click.
Your PC stays yours
The Lumo Melder accepts only a fixed list of commands and starts only games from your own list. Lumo AI needs a local confirmation on the PC, may only use a single folder and can be paused at any time.
Meetings stay between you
Voice and video in Lumo Meet travel encrypted directly between participants. We do not record or listen. Noise suppression runs on your device.
Safe monitoring
Monitors only reach public addresses, never internal networks. The server script runs as its own user without root, only measures and never executes commands from us.
Codes and links that expire
Device codes work once and for 10 minutes. Share links expire, can have a password and can be revoked at any time. Removed devices are signed out right away.
Protection against abuse
Rate limits on every public address, origin checks for every change, strict content types for downloads and the scam protection of the Lumo bot.
Your rights under the GDPR
Download all data we store about you in Lumo Team as a file and delete your personal data with one click. Closed tickets are deleted after 12 months, unaccepted drops after 14 days, notifications after 30 days. For help desks of teams we act as a processor with a data processing agreement.
Found a security issue?
Please tell us privately before you publish it. We answer quickly and fix confirmed issues with priority.
Report privately