Security & privacy
Security is part of how we build KOL Luminary: from workspace access and private files to the information sent to research providers. Here are the controls in the product, the boundaries that matter and the assurance work ahead.
Security overview · Updated October 5, 2026
Built into the product
Verified sign-in, workspace membership and role permissions protect server actions. Database row-level security separates organizations, with tenant-aware relationships to prevent records being attached across workspaces. Platform-owner administration requires a second factor.
Workspace files live in private storage with organization-specific paths. Our managed database and storage provider documents AES-256 encryption at rest and TLS in transit; the application uses HTTPS. Service credentials stay on the server, outside browser bundles.
Customer export downloads require a current authorized session. The file request rechecks access and returns private, non-cacheable content. Client-view exports exclude internal notes, ratings, relationship history and client feedback. Downloaded copies remain your team's responsibility.
Server-side input validation, safe rendering of external text, browser security headers and a per-request Content Security Policy help protect against injection and clickjacking. Shared rate limits protect sign-in and costly research and export operations.
Provider requests use explicit schemas that exclude private collaboration fields. Source retrieval checks destinations and limits redirects, size and time. External text is treated as untrusted; evidence is validated before it can support a finding.
Automated checks cover application behaviour, database isolation, permissions, private storage and browser boundaries. CI includes dependency auditing, type checks and builds. Audit histories preserve key edits, corrections and exports; production and staging have separate configuration.
Luminary is for public professional research and authorized business information. It is not a patient-record system and is not intended for protected health information (PHI).
Encryption and tenant isolation do not mean end-to-end encryption: authorized service infrastructure must process data to run your workspace. We do not claim that our operators or hosting providers are technically unable to access it.
How services support your workspace
We limit the information each service receives and keep privileged credentials on the server. This overview explains service roles and data boundaries. Provider identities, applicable terms and assurance evidence are available through a private client review; provider certifications do not certify KOL Luminary.
We provide the provider disclosures and change notices required by applicable law or customer agreements. Personal information may be processed or stored outside your country, including outside Canada, and may be subject to lawful access by authorities there. Processing locations and any residency requirements need a client-specific review.
Request provider detailsStores account and workspace records, private files and audit history. Luminary adds organization-level database and storage policies to control access.
Runs the website and server requests over HTTPS. Privileged values are configured for their deployment environment and kept out of browser bundles.
When enabled, receives selected public professional evidence and research criteria. This provider does not use API content for model training by default. Our resumable integration stores responses; provider retention applies and zero data retention is not claimed.
Receives research briefs, clarification messages and public criteria, not private collaboration fields. This provider’s published terms prohibit training on Customer Data, with an exception for aggregated de-identified data; account-specific terms still need review.
Runs trusted jobs for research, exports and maintenance using the workspace data needed for each task. Job dispatch uses record identifiers; workers resolve authorized records.
Collects payment details through a hosted checkout. Luminary stores billing references and subscription state, not full card numbers or security codes. Incoming billing notifications are signature-checked.
Supporting services deliver transactional email, process scrubbed error reports and handle optional, consented analytics where configured. Development services support source control and release checks. Research also retrieves public professional sources. The packet explains these roles and the remaining review work.
No-training is different from no-retention. Stored AI responses are subject to provider retention requirements; we do not offer a zero-retention guarantee.
Assurance roadmap · In progress
We are working towards ISO/IEC 27001 certification and a SOC 2 Type II attestation, with a target of the coming months. KOL Luminary is not currently certified to ISO 27001 and does not yet have a SOC 2 Type II report. Completion depends on readiness, the audit observation period and independent assessment; the timing is a goal, not a guaranteed approval date.
The client packet separates implemented safeguards from evidence still to complete, including independent penetration testing, recovery exercises, operational alerting and contractual vendor review. Ask us for current status as part of your procurement process.
If something goes wrong
Our runbook covers containment, investigation, customer notification, recovery and follow-up. Notification requirements are assessed as the incident develops, alongside containment and recovery.
Disable affected routes or tasks, revoke exposed credentials and preserve relevant evidence without copying sensitive records into tickets.
Identify affected workspaces, records and the exposure window. Notify affected customers through a private channel in line with applicable legal and contractual obligations, and share confirmed facts and protective steps.
Apply reviewed fixes, rotate affected credentials and verify database, storage, browser and worker boundaries before restoring affected operations.
Record the root cause, corrective actions, responsible owners and due dates. Use the findings to improve controls and the response process.
Report a concern to support@kolluminary.com. Start with a brief description and a way to reach you. Please do not email credentials, patient information or sensitive records; we can arrange a private follow-up.
Share our security packet with your IT, privacy or procurement team. It covers the architecture, access controls, AI handling, provider roles, retention, incident response and current assurance status.