LUMEN FOR IT TEAMS

Security and data handling

Updated September 16, 2026

This overview describes the current service. It is not a security certification, penetration test report, insurance policy, or promise that an incident cannot occur.

Roles and access

The community chooses its authorized staff and report recipients. Lumen operates the application and hosted reporting services. Community access uses device credentials. Inventory publishing requires separate authorization. Credentials can be revoked for future requests. Keep setup codes within the authorized team and report lost devices promptly.

Information boundaries

Inspection drafts, history, inspector names, notes and attachments synchronize within the connected community. The current reference inventory is public and includes fixture locations and reference media. Do not place confidential incidents or access information in reference inventory. Emailed map links grant access to anyone who possesses the link.

Hosting and delivery

Cloudflare hosts the service and stores shared information. Resend handles report and support email. Google hosts the support mailbox. Map reference services include OpenStreetMap and ArcGIS. HTTPS protects hosted requests in transit. We do not claim independent security certification or a dedicated customer hosting region.

Retention and removal

Emailed report file storage and hosted map links expire after 90 days. Shared history, inventory, administrative records and recipient copies have separate retention rules. Shared records have no automatic expiration at present. Revocation and deleting the app do not erase downloaded copies. See the privacy policy for details and contact support for a removal request.

Responsibilities and incident reporting

Lumen maintains its application and hosted service. The community manages its devices, authorized users, recipient mailboxes and maintenance procedures. Both parties should promptly communicate suspected misuse or exposure affecting the service. Report a concern through support with the affected community, approximate time and a description, without sending credentials. Incident investigation and any required notices depend on the facts and applicable law.

Organizational approval

IT should review the public inventory boundary, link based report access, device credential model, provider arrangements and retention needs before authorizing sensitive data. Requirements for private inventory, fixed deletion schedules, breach notification deadlines, audit reports, insurance, or service levels must be agreed separately. Publishing these pages does not mean those requirements have already been met.