Security & privacy, in plain language

Luum holds a complete picture of your finances, so it treats access to that picture as a property of the system, not a setting you have to get right. This page explains what that means in practice.

One note on the level of detail: we describe our safeguards by category rather than by tool, version, or configuration. A security page shouldn't double as a map for attackers, so where a specific matters, we say what it protects, not how it's wired.

Read-only, by construction

Brokerage connections are read-only. Luum can read positions and transactions. It cannot place trades, move cash, change a brokerage setting, or authorise anything. This is a property of the connection itself, not a permission that could be toggled on. There is no order path anywhere in Luum, including the rebalance simulator: it computes what-if trades and stops there.

Your credentials never touch Luum

Brokerage connections run through Snaptrade, a regulated open-finance platform. Authorisation happens on your institution's own login page. Luum never sees or stores your brokerage password. The connection token Snaptrade issues is envelope-encrypted with dedicated managed keys before it is stored, and it only ever grants the read-only access described above.

Where your data lives, and how it's protected

Your data is stored in Canada. Everything Luum keeps sits in an highly secure data center in Canada. It is encrypted at rest and in transit between your browser and Luum. Backups are encrypted the same way.

Protecting your account

Sign-up includes phone and email verification. You can also turn on two-step verification in Settings: an authenticator app supplies a six-digit code each time you sign in, and one-time backup codes cover a lost phone. Before the actions that can't be undone, such as deleting your account or disconnecting a brokerage, Luum asks you to re-verify your identity, including the code from your app when two-step verification is on, so a briefly unattended session can't do lasting damage. We also monitor sign-ups and usage for abuse patterns and apply rate limits throughout; we won't describe the specifics here, for the obvious reason.

Our own staff can't see your finances

Luum's internal admin tools run as a separate application from the one you use, not a hidden view bolted onto your dashboard. People operating it can see account status and aggregate usage, but cannot view your holdings, positions, transactions, or goals. That isolation is enforced in the data layer, where it cannot be worked around from the interface. The one admin action that touches your financial data is completing the account deletion you requested. Every administrative action is written to an append-only audit trail: Luum has no code path that edits an audit record once written. Two things do change those records, both deliberate and both privacy controls rather than corrections, the scheduled purge that removes records older than two years, and the unlinking of records from an account that has been deleted.

How we build the platform

Every change to Luum must pass an automated security gate before it can ship: static code analysis, dependency and secret scanning, container image scanning, and infrastructure checks, a failure blocks the release. Staging and production run in separate, isolated environments, access to them goes through centrally managed single sign-on, and secrets live in a managed secrets store, never in code, with rotation monitoring.

Monitoring and response

Errors, failed background jobs, and unusual infrastructure behaviour raise alerts rather than waiting to be noticed. A database snapshot is taken before every deploy. We maintain written incident-response runbooks, including for the unglamorous scenarios, a bad deploy, a critical vendor outage, so the response to a problem is a procedure, not an improvisation.

Your data's lifecycle

You can export your data at any time, in full. Deleting your Luum account deletes your data, the process is automated end-to-end, and an erasure-status page lets you verify where it stands. Because Luum holds no money and no securities, deleting your account touches nothing you own. We also minimise what we keep along the way: audit records are retained for two years and then purged automatically, uploaded files expire on a schedule, and IP addresses are stored only in one-way hashed form, never raw.

When processing crosses borders

Some processing crosses borders because the tools involved are US-based: sign-in (Clerk), billing (Stripe), and the AI assistant, which sends your portfolio context to Anthropic's Claude API to answer your questions, not used to train models, and only invoked if you use that feature. Brokerage authorisation tokens pass through Snaptrade, which operates in both Canada and the US. Every vendor with access to any of this is bound by a data processing agreement; the complete list is in the privacy policy.

Privacy law and compliance

Canada's federal privacy law, PIPEDA, shapes how Luum handles personal information. It is why your data is stored in Canada, why deletion is automated and verifiable, and why retention is limited. Email follows CASL: commercial messages always carry a working unsubscribe, and analytics run only if you opt in, decline, and the analytics code never loads at all. For US users, a CCPA/CPRA supplement sits alongside the Canadian privacy policy.

SOC 2: audit readiness is in progress. We are formalising controls, policies and evidence collection now, and will update this page as that work advances. Until an independent audit is complete, we won't claim the badge, only the work.

How our security gets reviewed

Today, by us. The automated gates above run on every change, and significant releases get a documented security review before they ship. This site's own pre-launch review is an example, and its findings were fixed before it went public.

We have not yet commissioned a penetration test or security assessment from an independent third-party firm. When we do, we'll say so here. That is the same standard as the SOC 2 note above: we describe the work we have actually done, not the work we intend to do.

No advice, by design

Luum surfaces figures and lets you sort them; it never tells you what to buy or sell. That boundary is part of what keeps it an educational tool rather than an adviser, and it is also a security property: a system with no order path and no advice engine is a smaller target than one with either.

Reporting a security concern

If you believe you've found a vulnerability in Luum, email security@luumwealth.com. Tell us what you found and how to reproduce it; we'll acknowledge your report, keep you informed, and won't take action against good-faith research.

For the complete legal terms, see the Privacy Policy and Terms of Service.