Security at Lumi
How Lumi protects your account, your projects and the sites you publish, and how you can keep your own users' data safe.
HTTPS everywhere
Lumi and every site you publish are served over HTTPS. When you connect a custom domain, Lumi issues and renews its certificate automatically.
Secrets stay out of your code
API keys for backend functions are stored as project secrets, not in your code. They are encrypted in your browser before they are sent to Lumi.
Data permissions
Each collection in your database has its own permissions. You decide whether anyone, signed-in users or only the owner of a record can read or change it.
Secure sign-in for your users
Sign-in for the sites you build runs on a separate login page provided by Lumi, with email and Google sign-in, so passwords never pass through your own code.
Payments
Payments for Lumi plans are handled by Stripe on the web, and by the App Store or Google Play in the mobile app. Lumi does not store your card numbers.
Abuse prevention
We review reports and take sites offline when they are used for phishing, malware, fraud or other abuse, as described in our Acceptable Use Policy.
Reporting a security issue
If you find a security problem in Lumi, please email us with the subject "Security" and enough detail to reproduce it. Please do not share it publicly until we have had a chance to fix it.
Security reports and questions: [email protected]