Security and compliance at Lumen

Security controls apply equally to the managed cloud and to self-hosted gateway deployments. Self-hosted customers manage their own encryption keys.

Encryption and access

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Role-based access control provides four roles: owner, admin, operator, and viewer. Only owners can change billing or delete a site.

Single sign-on

Enterprise plans support SSO through SAML 2.0 and OpenID Connect. Okta, Microsoft Entra ID, and Google Workspace are validated identity providers. SCIM 2.0 provisioning is available on Enterprise plans only.

Data retention

Raw telemetry retention depends on the plan: 30 days on Starter, 90 days on Growth, and 365 days on Enterprise. Enterprise retention can be configured up to three years. Encrypted backups are kept for 35 days. Deleted sites are purged from backups within 45 days.

API keys and audits

API keys must be rotated at least every 90 days. Rotation creates a second active key and keeps the previous key valid for 24 hours so ingestion can switch without a gap. Audit logs record authentication, permission changes, exports, and key rotation, and are retained for one year.

Certifications

Lumen maintains SOC 2 Type II and ISO 27001 certifications. Penetration test summaries are available to customers under NDA.