Snapshot 250012
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Luzmo is an embedded data visualization platform built with security and privacy at its core. We understand that your data is one of your most valuable assets, which is why we've implemented industry-leading security measures and compliance certifications to ensure your information remains protected at all times. Haroen Vermylen Chief Technology Officer, Luzmo Compliance Download reports SOC2 Type 2 HIPAA Privacy Regulations ✓ 🇪🇺 GDPR (EU) > ✓ 🇺🇸 CCPA/CPRA (California) > ✓ 🇺🇸 VCDPA (Virginia) > ✓ 🇺🇸 CPA (Colorado) > ✓ 🇺🇸 CTDPA (Connecticut) > ✓ 🇺🇸 UCPA (Utah) > ✓ 🇬🇧 UK GDPR > ✓ 🇨🇭 FADP (Switzerland) > ✓ 🇦🇺 Privacy Act (Australia) > ✓ 🇨🇦 PIPEDA (Canada) > NIS2 Luzmo is compliant with the NIS2 directive. EU Data Act Luzmo is compliant with the EU Data Act. EU AI Act Luzmo is compliant with the EU AI Act. Controls View all controls Reports Certificates SOC2 Type 2 Report 2026 SOC2 Type 2 Report for the reporting period of Jan 1st, 2025 until Dec 31st, 2025 SOC2 Type 2 Report 2025 SOC2 Type 2 Report for the reporting period of Jan 1st, 2024 until Dec 31st, 2024 SOC2 Bridge letter 2025 Bridge letter for the period since Jan 1st 2026 Penetration Tests Penetration Test 2025 - 3rd party report Penetration Test 2025 - 3rd party report General Data Processing Agreement Standard Luzmo Data Processing Agreement template Controls Subprocessors Amazon Web Services EMEA SARL Cloud service provider. 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg. User IP address, e-mail, name and historical usage data. Storage and processing of uploaded or connected customer datasets. EU or US ClickHouse, Inc. Cloud service provider. 650 Castro St, Ste. 120 Unit 92426, Mountain View, CA 94041, United States. Storage and processing of uploaded or connected customer datasets. EU or US Twilio Inc. Cloud-based e-mail. 101 Spear Street, Suite 500, San Francisco, CA 94105, United States. User e-mail address and name for password resets, legal notices, scheduled dashboard exports, and alerts via e-mail or SMS. These messages may contain attached PNG or PDF exports of dashboards, or data matching the alert configuration. USA OpenAI AI inference and embeddings provider. Customer data which may contain personal data (including prompts, conversation history and query context) is processed via AI features, filtered through Luzmo's access control. Queries and category lookups run in Luzmo's query engine, outside the model. EU tenancy — OpenAI Ireland Ltd. The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Processed via OpenAI's European regional endpoint with EU data residency (or the regional equivalent for dedicated environments). Prompts and responses are not logged or retained by OpenAI for abuse monitoring or human review, and are not used to train models. Luzmo has performed a data protection impact assessment for this sub-processor. US tenancy — OpenAI OpCo, LLC. 1455 3rd Street, San Francisco, CA 94158, United States. Processed via OpenAI's global API endpoint (api.openai.com). Prompts and responses are not used to train models. Luzmo has performed a data protection impact assessment for this sub-processor. Feature What the model sees Column and dataset descriptions Metadata suggestions Formula generation Metadata only. Names, types and descriptions. No cell values and no query results. Chart generation Dashboard creation Category values. A sample of distinct values from category columns, plus further lookups when a filter needs an exact value. Those values can include personal data. The model does not receive measure results or the chart's query output. AI summaries Luzmo IQ Luzmo IQ agentic APIs and MCP Query results, which may include personal data. Results are aggregated unless the chart or question is a row listing. Category values may also be looked up, or embedded, to match a filter or a classification. AI features can be disabled centrally on the Organization settings page. See OpenAI's Trust Center for more information. EU or US Frequently Asked Questions + How does Luzmo protect my data? Luzmo employs multiple layers of security including encryption at rest and in transit, regular security assessments, and strict access controls to protect your data. + Is Luzmo GDPR-compliant? Yes, Luzmo is fully GDPR compliant. We act as a data (sub)processor for our customers and have implemented all necessary measures to comply with GDPR requirements. If you wish to process Personally Identifiable Information (PII) on the Luzmo platform, you can sign a Data Processing Agreement (DPA) with us in Luzmo's Legal & Compliance section. + Does Luzmo store my data? Whether we store your data depends on the data connector types you're using and your settings. By default, Luzmo does not store your data, but only processes it in-memory after which it is promptly discarded. If you enable query result caching on a connection or dataset, we temporarily cache your data in an in-memory store up to your configured Time-To-Live (TTL). If you use any of the following data connector types or features, we persistently store your data in a secure, multi-dimensional analytical data store, until you delete the dataset or the license comes to an end. Google Analytics Google Drive Luzmo API Push Luzmo Warp + Where does Luzmo process and/or store my data? Luzmo operates 2 multi-tenant clouds: in the European Union 🇪🇺 (AWS, eu-west-1 (Ireland) region) and in the United States 🇺🇸 (AWS, us-east-2 (Ohio) region). You can choose your data tenancy during sign-up. Your data is strictly processed and/or stored only in your selected regions. Luzmo offers dedicated cloud deployments in any public AWS, Azure or Google Cloud Platform region globally. Customers can also opt for a EU sovereign cloud deployment on Scaleway or OVHCloud. Luzmo offers a Helm Chart self-hosted edition. Specific pricing applies. + How can I securely connect my data to Luzmo? Luzmo connects to a variety of data sources natively, incl. relational databases (PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, etc.), data warehouses (ClickHouse, Snowflake, BigQuery, Redshift, Athena, Synapse, etc.), file systems (Google Drive), Google Analytics, and more. Luzmo uses TLS1.2+ encrypted connections. You can use IP whitelisting to allow our dedicated IP addresses to connect. We also offer AWS Private VPC endpoints on our Multi-tenant Cloud and AWS Private VPC Endpoints or AWS, Azure or Google Cloud VPC Peering on dedicated cloud deployments. It's also possible to create your own data connectors using our Plugin API. + Does Luzmo train AI models with my data? Do you send my data to AI model providers? Luzmo's AI features, including chart/dashboard agents and Luzmo IQ, are not trained on customer datasets. Luzmo logs conversations for the duration of our regular log retention window to help in issue investigations or to identify areas where the service accuracy needs to be improved. Luzmo uses OpenAI's API for AI features, with data residency matching the Luzmo multitenant cloud or dedicated cloud residency. OpenAI does not use prompts or responses to train models. Luzmo has a zero data retention agreement with OpenAI: OpenAI does not store any data from Luzmo's usage of their API. What the model receives depends on the feature. Lookups and queries run in Luzmo's query engine, under the viewer's access control, outside the model. Metadata only: column and dataset descriptions, metadata suggestions, and formula generation. The model sees names, types and descriptions. No cell values and no query results. Category values: chart generation and dashboard creation. The model receives a sample of distinct values from category columns, and further lookups when a filter needs an exact value. Those values can include personal data. It does not receive measure results or the chart's query output. Query results: AI summaries, Luzmo IQ, and Luzmo IQ agentic APIs and MCP. The model receives the query result, which may include personal data. Results are aggregated unless the chart or question is a row listing. Category values may also be looked up, or embedded, to match a filter or a classification. + Is Luzmo compliant with HIPAA? Yes, Luzmo is compliant with HIPAA (Health...) regulations. If you wish to process healthcare records that fall under HIPAA regulations, you can request a BAA. Responsible Disclosure Program We value the security research community and encourage responsible disclosure of security vulnerabilities. Our responsible disclosure program rewards security researchers who help us keep Luzmo secure. Program Guidelines & Leaderboard Hall of Fame Special thanks to the following researchers who have reported vulnerabilities to us: Rank Researcher Points 1 Anonymous 🇳🇱 Dutch researcher 105 2 Anonymous 🇵🇱 Polish researcher 100 3 Anonymous 🇪🇸 Spanish researcher 70 4 Anonymous 🇬🇧 UK researcher 65 5 Anonymous researcher 50 + 25 other researchers Guidelines • Please provide a detailed report with reproducible steps. • Only provide reports that have clear and important security implications. Not all product quality issues are vulnerabilities. • Please provide sufficient time before reporting recently discovered CVEs or outdated dependency versions. We regularly scan for new CVEs, but releasing new versions takes time to provide sufficient quality control. • We are especially interested in reports related to: - Remote code execution - SQL injection - Cross-organization privilege escalation - Data breaches - Exploitable SSRF (ie. blind SSRF leading just to a pingback is excluded) - Stored XSS • Following reports are out-of-scope of our program: - Clickjacking, reverse tabnabbing - Phishing via user-generated content (eg. notification e-mails, dashboard sharing) - CORS configuration - Pre-Auth Account takeover/OAuth squatting - Disclosure of Luzmo API tokens of third parties -- you can report these, but we will not award points - Bugs without clear security impact, eg. missing rate-limits/security headers/cookie flags, best practices violations, autocomplete, self-XSS, version disclosure, disclosure of API keys meant to be public, etc. • Luzmo allow security testing of its services for the purpose of responsible disclosure. Please do not abuse found vulnerabilities. Please do not use automated scanning tools that exceed the rate limits (10 req/s). We will ban abusers and reserve the right to take further steps in case of repeated abuse. • To thank you for your submissions, we'd love to publish your name in our security leaderboard andsend you an official Luzmo swag package upon reaching 15 points worth of accepted vulnerabilities. Please provide your address in the submission form if you want to participate in this. We only process your address for the purpose of sending you a swag package. • Leaderboard points are awarded for validated, accepted submissions. Duplicate submissions are rewarded with half points. Points are awarded by final severity of the finding: - Critical finding: 50 points - High severity finding: 25 points - Medium severity finding: 10 points - Low severity finding: 5 points Submit a Vulnerability © Luzmo. All rights reserved.