All systems monitored · Controls passing

Lumenfold Trust Center

How we protect your company's spend data: the frameworks we're audited against, the controls we run, and the documents your security team needs.

Request documents See frameworks

Last updated November 3, 2026

A shield with a check mark surrounded by SOC 2, ISO 27001, GDPR and HIPAA badges

Compliance frameworks

Independent audits and the standards we align to.

SOC 2
Type II

SOC 2 Type II

Compliant

Audited by a fictional CPA firm. Period ending 2026-06-30.

ISO
27001

ISO 27001:2022

Certified

Certificate valid through 2028-03.

ISO
42001

ISO 42001

In progress

AI management system; Stage 1 audit scheduled.

GDPR

Aligned

DPA with SCCs available to customers.

CCPA

Aligned

Service-provider terms in the DPA.

HIPAA

Compliant

BAA available on the Enterprise plan.

PCI DSS
v4.0

PCI DSS v4.0

SAQ A

Card data handled by Stripe; Lumenfold never stores PANs.

NIST
CSF 2.0

NIST CSF 2.0

In progress

Self-assessment against all six functions.

Documents

Public documents open directly. Reports marked "NDA required" need a signed NDA.

SOC 2 Type II report (2026)NDA required

ISO 27001 certificatePublicView

ISO 27001 Statement of ApplicabilityNDA required

Penetration test summary (Q2 2026)NDA required

Data Processing AgreementPublicView

Business Associate Agreement templateNDA required

Information security policyPublicView

Completed SIG Lite questionnaireNDA required

CAIQ v4NDA required

Security controls

Continuously monitored. 25 of 25 controls passing.

Infrastructure security

5/5 passing

Production data encrypted at rest (AES-256)
TLS 1.2+ for all data in transit
Unique production database credentials
Firewall rules reviewed quarterly
Intrusion detection on production hosts

Organizational security

5/5 passing

Security awareness training at hire and annually
Background checks for all employees
Confidentiality agreements signed
Asset inventory maintained
Access reviewed quarterly

Product security

5/5 passing

SAML SSO and SCIM provisioning
Annual third-party penetration test
Vulnerability scans run weekly
Role-based access in the app
Audit log export

Internal security procedures

5/5 passing

Incident response plan tested annually
Business continuity and DR plan
Change management with peer review
Vendor risk reviews before onboarding
Whistleblower channel available

Data and privacy

5/5 passing

Data retention policy enforced
Customer data deletion on request
Data classification policy
Privacy policy published
Subprocessor list maintained

Subprocessors

Third parties that process customer data on our behalf.

Subprocessor	Purpose	Location
Amazon Web Services	Cloud hosting	United States
Stripe	Payment processing	United States
Google Workspace	Email and documents	United States
Intercom	Customer support messaging	United States
Segment	Product analytics pipeline	United States
Datadog	Monitoring and logging	United States
Okta	Employee identity	United States

FAQ

Where is customer data stored?

In AWS us-east-1, with encrypted backups in us-west-2. EU data residency is available on Enterprise.

How do I report a vulnerability?

Email security@lumenfold.example. We reply within one business day.

Do you sign customer security addenda?

Yes, on Growth and Enterprise plans.