Security

This page exists so your firm can satisfy its own vendor oversight obligation under 17 C.F.R. § 248.30(a)(2)(ii) or 16 C.F.R. § 314.4(f) without having to email us first. It is written as substantiation for the Data Processing Addendum, not as marketing, which is why the last section is the one about what we do not have.

Architecture

Hosting

Railway, in the United States. Application and managed PostgreSQL with the pgvector extension. Documents are held on a persistent volume, not on ephemeral container storage.

In transit

TLS 1.2 or higher for every connection, including between the application and the database.

At rest

Encrypted by the platform at the volume level. Field-level encryption of the most sensitive elements is not yet implemented; see the last section.

Data residency

United States only. No offshore processing, and no subprocessor outside the United States. The full list is at subprocessors.

Isolation between customers

We will describe this precisely rather than using the word “isolated” and leaving you to assume what it means.

Today, each customer runs on its own deployment with its own database. There is no shared database and therefore no query that could return another firm’s row. This is the strongest isolation model available and it is how founding customers are onboarded.

We are building shared multi-tenant hosting, because a deployment per customer does not scale to self-serve signup. It will use a separate database schema per firm, with the search path bound per connection, and it will not ship without an isolation test suite that attempts cross-tenant reads and fails the build if any succeeds. When it ships, this page changes and your firm’s administrators are told directly. Your firm can also elect to remain on a dedicated deployment.

Access and accountability

Authentication

Signed tokens with short-lived access tokens and rotating refresh tokens. Passwords are hashed with bcrypt.

Authorization

Role-based, across four roles from employee to chief compliance officer, with per-module overrides your CCO controls. An employee sees their own filings and nothing else.

Audit trail

Every mutation is recorded with actor, action and timestamp. The log carries periodic integrity checkpoints so tampering is detectable rather than merely discouraged, and it exports for an examiner.

Luna personnel

Access is limited to people who need it to operate or support the Services, and is logged. We do not browse customer data.

How AI processing works

Model provider

Anthropic, under its commercial terms, which state that Anthropic may not train models on customer content submitted through the API. We submit under those terms, not consumer terms.

No training

We do not use your data to train, fine-tune or evaluate any model. This is a contractual commitment in Terms §4.3, and §11.2 means we cannot change it except at your renewal.

What is sent

The text of the document under review, and the rules and policies it is reviewed against. Brokerage account numbers and credentials are not sent to a model.

Human decision

Every output routes to a person at your firm with its contributing factors shown. Nothing acts on a model output automatically.

Incidents

We maintain a written incident response program covering detection, assessment, containment, notification and post-incident review.

We notify your firm within 72 hours of becoming aware of unauthorized access to a system holding your data. That trigger is unauthorized access to a system, not confirmed exfiltration of data, because that is where § 248.30(a)(5)(i)(B) sets it. It is a more onerous commitment than most vendors give, and it is in the DPA rather than only on this page.

What we do not have yet

A security page that lists only strengths is not useful to someone doing diligence. Here is the honest gap list, and we will move items off it rather than quietly rewording them.

Reporting and requests

Vulnerabilities

security@lunacompliance.io. We will not pursue a good-faith researcher who reports privately, does not access another customer’s data, and gives us a reasonable period to fix the issue before publishing.

Diligence requests

legal@lunacompliance.io. We respond to a security questionnaire once per twelve-month period under a confidentiality undertaking, per DPA §8.