NEW white paper validating Prime+ for conventional lending · Click Here

Trust & Security

Security Commitments

Lumos’ background in banking and financial services instilled a strong discipline around data and information security. This page gives clients and prospective clients an objective view of how we secure our infrastructure, our people, and the data entrusted to us.

AICPA

SOC

Visit our Trust Center

security@lumosdata.com

Last updated: October 21, 2026

SOC 2 Type 2

Independently examined against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality.

Continuous monitoring

Controls, cloud accounts, and devices are monitored continuously through our compliance platform, not just at audit time.

Encryption

Data is protected in transit and at rest under our Encryption and Key Management Policy.

Least-privilege access

Single sign-on, enforced multi-factor authentication, managed VPN, and regular access reviews.

Independent assurance

Independently audited. Continuously monitored.

Lumos has completed a SOC 2 Type 2 examination performed by an independent CPA firm. Our controls are tracked continuously through an automated compliance platform, and our full SOC 2 report is available to clients and prospects through the Lumos Trust Center.

Trust Services Criteria in scope

Security

Availability

Confidentiality

Request the SOC 2 report

Infrastructure

Built on partners trusted by banks and governments

Lumos runs on well-established providers that continually manage risk and undergo recurring independent assessments. Each is risk-assessed and reviewed under our Vendor Management Policy. Their key attestations are listed below.

Amazon Web Services

Hosts the Lumos production platform in a US-based AWS region, including our APIs, compute, storage, and DNS. Data at rest is encrypted with keys managed in AWS KMS.

ISO 27001

SOC 1 / SOC 2 / SOC 3

PCI DSS Level 1

FISMA Moderate

Databricks

Runs the data engineering pipelines, data warehouse, and machine learning models that power Lumos scores, reports, and dashboards.

SOC 2 Type II

ISO 27001 / 27017 / 27018

HIPAA

PCI DSS

WorkOS

Powers sign-in to the Lumos Portal, including passwordless login and enterprise single sign-on. Lumos never stores user passwords.

SOC 2 Type II

GDPR

CCPA

Stripe

Processes payments for self-service dashboard subscriptions. Checkout and billing happen on Stripe-hosted pages, so card details never touch Lumos systems.

PCI DSS Level 1

SOC 1 / SOC 2 Type II

SOC 3

Our practices

How we protect your data

People & accountability

Every team member passes a background check before onboarding, completes security training at hire and annually, and formally acknowledges our Code of Conduct and security policies. Violations lead to disciplinary action up to and including dismissal.

Identity & access

Access follows least privilege. Employees sign in through single sign-on with enforced multi-factor authentication, keep credentials in a company-managed password manager, and connect over a managed VPN. Access is reviewed regularly and revoked promptly when roles change.

Secure development

No single engineer can change the Lumos codebase alone. Every change goes through peer review and approval under our Change Management Policy, and repositories are scanned automatically for vulnerable dependencies and insecure code.

Data quality & model risk

Data behind Lumos products is cleaned, vetted, and verified, and every new data product is reviewed by someone not involved in building it. Our model risk management framework covers development, validation, and use; each model has Model Risk Management documentation, available on request, and is subject to third-party audit.

Data classification & handling

All data is classified under our Data Classification Policy and handled with access, encryption, and retention controls matched to its sensitivity. Retention and secure disposal follow our Data Retention and Disposal Policy.

Endpoint security

Company devices are centrally managed and must maintain disk encryption, malware protection, an enabled firewall, disabled guest access, and current OS updates. Compliance is monitored continuously.

Monitoring & availability

Infrastructure monitoring and security scanning tools watch network traffic and service health around the clock. Service status is published on our Status Page, where clients can subscribe to alerts, and a documented Business Continuity and Disaster Recovery Plan protects operations.

Vulnerability management

Regular web and threat scans surface vulnerabilities, which are ticketed, prioritized by urgency, and tracked by the Security Team until resolution is verified, in line with our Vulnerability and Patch Management Policy.

Incident response

Our Security Incident Response Plan defines how events affecting confidentiality, integrity, or availability are identified, escalated, mitigated, and reported. Incidents that affect clients always receive the highest priority and shortest resolution time.

Vendor risk management

Every vendor that touches Lumos systems or data is risk-assessed before onboarding and reviewed on an ongoing basis, including their own security attestations.

Responsible use of AI

Our Generative AI Policy governs any AI tool that touches Lumos systems or client data. Only approved tools may be used, client data is processed only under contractual safeguards such as no-training and limited-retention terms, and AI never replaces human judgment for decisions that materially affect clients.

Contact

Questions about security?

Reach our Security Team directly, or request our SOC 2 report and security documentation through the Trust Center.

Lumos Technologies

Attention: Lumos Security Team

106 Market St, Suite 300

Wilmington, NC 28401

Phone: (910) 210-0040

security@lumosdata.com

Ready to see Lumos in action?

Book a 30-minute demo. No pressure, no sales pitch. Just a straightforward conversation about whether Lumos is right for you.

Request My Demo

What To Expect:

Quick platform overview

Live demo with real loan examples

Discussion of your specific needs

Clear next steps

"The data and insights provided by Lumos have been instrumental in driving numerous policy changes within our organization."

VP, Senior Product Manager, US Bank