Security & privacy, in plain language

Luum holds a complete picture of your finances, so it treats access to that picture as a property of the system, not a setting you have to get right. This page explains what that means in practice.

One note on the level of detail: we describe our safeguards by category rather than by tool, version, or configuration. A security page shouldn't double as a map for attackers, so where a specific matters, we say what it protects — not how it's wired.

Read-only, by construction

Brokerage connections are read-only. Luum can read positions and transactions. It cannot place trades, move cash, change a brokerage setting, or authorise anything — this is a property of the connection itself, not a permission that could be toggled on. There is no order path anywhere in Luum, including the rebalance simulator: it computes what-if trades and stops there.

Your credentials never touch Luum

Brokerage connections run through Snaptrade, a regulated open-finance platform. Authorisation happens on your institution's own login page — Luum never sees or stores your brokerage password. The connection token Snaptrade issues is envelope-encrypted with dedicated managed keys before it is stored, and it only ever grants the read-only access described above.

Where your data lives, and how it's protected

Your data is stored in Canada — everything Luum keeps sits in an highly secure data center in Canada. It is encrypted at rest and in transit between your browser and Luum. Backups are encrypted the same way.

Protecting your account

Sign-up includes phone and email verification. Before the actions that can't be undone — deleting your account, disconnecting a brokerage — Luum asks you to re-verify your identity, so a briefly unattended session can't do lasting damage. We also monitor sign-ups and usage for abuse patterns and apply rate limits throughout; we won't describe the specifics here, for the obvious reason.

Our own staff can't see your finances

Luum's internal admin tools run as a separate application from the one you use — not a hidden view bolted onto your dashboard. People operating it can see account status and aggregate usage, but cannot view your holdings, positions, transactions, or goals. That isolation is enforced in the data layer, where it cannot be worked around from the interface. The one admin action that touches your financial data is completing the account deletion you requested. Every administrative action is logged, and those logs are kept in tamper-resistant, write-once storage.

How we build the platform

Every change to Luum must pass an automated security gate before it can ship: static code analysis, dependency and secret scanning, container image scanning, and infrastructure checks — a failure blocks the release. Database changes are additionally screened for unsafe migration patterns. Staging and production run in separate, isolated environments, access to them goes through centrally managed single sign-on, and secrets live in a managed secrets store — never in code — with rotation monitoring.

Monitoring and response

Errors, failed background jobs, and unusual infrastructure behaviour raise alerts rather than waiting to be noticed. A database snapshot is taken before every deploy. We maintain written incident-response runbooks, including for the unglamorous scenarios — a bad deploy, a critical vendor outage — so the response to a problem is a procedure, not an improvisation.

Your data's lifecycle

You can export your data at any time, in full. Deleting your Luum account deletes your data — the process is automated end-to-end, and an erasure-status page lets you verify where it stands. Because Luum holds no money and no securities, deleting your account touches nothing you own. We also minimise what we keep along the way: audit records are retained for two years and then purged automatically, uploaded files expire on a schedule, and IP addresses are stored only in one-way hashed form, never raw.

When processing crosses borders

Some processing crosses borders because the tools involved are US-based: sign-in (Clerk), billing (Stripe), and the AI assistant, which sends your portfolio context to Anthropic's Claude API to answer your questions — not used to train models, and only invoked if you use that feature. Brokerage authorisation tokens pass through Snaptrade, which operates in both Canada and the US. Every vendor with access to any of this is bound by a data processing agreement; the complete list is in the privacy policy.

Privacy law and compliance

Canada's federal privacy law, PIPEDA, shapes how Luum handles personal information — it is why your data is stored in Canada, why deletion is automated and verifiable, and why retention is limited. Email follows CASL: commercial messages always carry a working unsubscribe, and analytics run only if you opt in — decline, and the analytics code never loads at all. For US users, a CCPA/CPRA supplement sits alongside the Canadian privacy policy.

SOC 2: audit readiness is in progress. We are formalising controls, policies and evidence collection now, and will update this page as that work advances. Until an independent audit is complete, we won't claim the badge — only the work.

Independent security review

Beyond our own automated gates and internal reviews, Luum undergoes recurring security assessments by independent third-party firms. We act on the findings in a timely manner.

No advice, by design

Luum surfaces figures and lets you sort them; it never tells you what to buy or sell. That boundary is part of what keeps it an educational tool rather than an adviser — and it is also a security property: a system with no order path and no advice engine is a smaller target than one with either.

Reporting a security concern

If you believe you've found a vulnerability in Luum, email security@luumwealth.com. Tell us what you found and how to reproduce it; we'll acknowledge your report, keep you informed, and won't take action against good-faith research.

For the complete legal terms, see the Privacy Policy and Terms of Service.