A complete register of the technical and organizational controls that protect client organizations, their programs, and the people they serve, described exactly as implemented, with honest limits stated plainly.
Reviewed August 2026 · Legacy X LLC, a Pennsylvania limited liability company, d/b/a Luminary Impact · Scope: the client portal (lilxhub.app)
Live implemented and verified in the client portal Ops-managed enforced in the operations platform Rolling out in active development
Identifying fields are split off at collection into a table readable only by the client organization's own logins, enforced by database row level security. Operators, AI systems, and support staff have no read path. Verified by query.
Every downstream record carries only a code (for example, P-4X7K2). Deliverables never name a participant.
Identifiers (name, email, phone) are AES-256-GCM encrypted with a server-held key before storage, and decrypted only server side for the client's own view.
Briefs, notes, uploads, and self serve AI inputs are screened for participant identifiers. A hit is rejected before storage: nothing lands, even briefly.
PDFs and images cannot be content screened, so uploading one requires an explicit confirmation that it contains no participant identifiers.
Passwordless, phishing resistant login with fingerprint, Face ID, or device PIN.
Opt in authenticator app second factor with a server side step up guard. Mandatory for operator accounts.
Stored hashed.
A length and variety floor plus a HaveIBeenPwned k-anonymity check. The password never leaves the device.
Automatic sign out after 30 minutes of inactivity.
Sign out of all devices, in one action.
Every table of client data is organization scoped at the database.
Client admin, read only viewer, and operator roles.
Operator access narrows to assigned organizations, with flagged, logged, non silent administrative overrides.
The one role database rules do not bind is restricted to our own server code.
A client's AI context is drawn only from that client's own brief and brand.
Enforced CSP with a per request nonce and strict-dynamic, blocking injected and inline scripts, with violation reporting.
HSTS (two year, preload), X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Durable, fail open rate limits on sensitive actions.
Non public buckets with short lived signed URLs only.
Framework server actions with origin verification.
A published security.txt (RFC 9116).
Committed under our AI provider's commercial API terms.
AI has no technical capability to deliver work to a client or any third party.
AI systems cannot read participant identities.
Measured results labeled measured, judgment labeled judgment, gaps flagged rather than invented, participants by code.
Each record is sealed in a SHA-256 hash chain, and a verifier reports the first break.
Clients see the actions taken on their requests (submitted, produced, reviewed, delivered, approved). The timeline states plainly that it shows actions, not reads.
A metadata record of each read (actor class, data class, timestamp, never content), surfaced to the client.
Written confidentiality obligations are signed before any access is granted.
TLS in transit; AES-256 at rest, including backups.
A current, patched framework with active dependency vulnerability management.
Any time during the term, and for 30 days after.
Active systems within 60 days of termination, backups within 90 days, confirmed in writing.
A 72 hour notification commitment, per the Data Processing Agreement.
A defined data retention schedule with legal holds.
The Privacy Policy, Terms, DPA, AUP, AI Disclosure, and Subprocessor Disclosure are kept consistent with what the platform actually does.
All access to client data is by our own personnel, in the United States, under written confidentiality obligations. No offshore talent works on the platform or accesses client data.
Agreements are signed in platform and sealed with a content hash and a certificate of completion.
We describe controls as implemented and verified, and we do not claim certifications we do not hold.
| Provider | Function | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | United States |
| Vercel | Application hosting | United States |
| Anthropic | AI drafting | United States |
| Stripe | Payments | United States |
| Resend | Transactional email | United States |
| Twilio | SMS | United States |
| Netlify | Marketing website | United States |
The full list, with what each provider can reach and our 30 day change notice, is in the public Subprocessor Disclosure.
Privacy Policy · Terms of Service · Data Processing Agreement · Acceptable Use Policy · AI Disclosure and Consent · Subprocessor Disclosure
Full architecture detail, including the participant identity vault and how we use AI, is on the Trust Center. Security questions and vulnerability reports: support@lilxhub.com with Security in the subject line.