Security
Lunon keeps your client material safe with enterprise-grade security and data privacy controls.
Enterprise-grade protection
Security is owned by Lunon’s founding engineering team. Every internet-facing service is scanned weekly, every deploy is checked for vulnerable dependencies and images, every change is scanned for secrets, and every finding carries a remediation deadline.
You decide what enters an engagement. Material is scoped to that engagement, hosted in the United States, retained only for the life of the work, and returned or deleted at close on your instruction.
Lunon does not use your documents, data, or deliverables to train models. We use our model providers through their APIs with training disabled, so your material is not used to train their models.
Every engagement is its own boundary. Isolation is enforced at the database layer, access is limited to the team on your engagement, and every access is written to an append-only audit trail.
Every engagement begins under NDA. Our agreements carry binding terms on confidentiality, data handling, deletion at close, and no training, aligned with the SOC 2 Trust Services Criteria.
Lunon's SOC 2 Type I and Type II audits are underway with an independent CPA firm, covering the Security criteria. Controls are monitored continuously, every internet-facing service is scanned weekly, and findings are remediated to closure.
Lunon is built on a non-negotiable principle: the confidentiality of the material clients share with us. The platform was designed from the first commit to protect the most sensitive information in a transaction.
Lunon is being audited by an independent CPA firm against the AICPA Trust Services Criteria for Security. The Type I and Type II reports will be available to clients and prospects under NDA once issued.
TRUST SERVICES CRITERIA IN SCOPE
Security
Systems are protected against unauthorized access, disclosure, and damage.
Security is fundamental to everything we do
We built one system that protects client material at every level, from identity and tenant isolation to scanning, auditing, and deletion. The controls are tested continuously and remediated on a clock, so the trust clients place in us is earned every week, not once a year.
Start with the decision in front of you.
Tell us what your team needs to understand, evaluate, or deliver.