How we protect the data that runs your funding

When someone fills out one of your forms, any identifying fields are split off at the moment of collection into a separate identity vault, and the working record gets a code (like P-4X7K2). Everything downstream — analysis, reporting, drafting — runs on codes.

• The vault is readable only by your organization’s own logins. Our operators, our AI systems, and our support staff have no read path — the database itself refuses. We verify this by direct query under every internal role.
• You can look up who P-4X7K2 is inside your own portal, because they’re your participant. We can’t.
• Nothing we produce for you ever names a participant. Codes only.

• Assignment-scoped access Rolling outaccess will narrow to the operator(s) assigned to your organization, so unassigned staff are denied before your data loads. Today, access to your strategy is limited to Luminary’s own delivery personnel under confidentiality obligations — never offshore staff.
• Audited overrides Rolling outan administrator override will be flagged, logged, and visible, never silent.
• Reads, recorded Rolling outwe’re instrumenting a metadata record of each read of your briefs — who, what, when, never the content. Today your portal’s Activity view shows the actions taken on your requests (submitted, produced, delivered, approved); the full read log is being surfaced there as it rolls out. We won’t call it an access log until it is one.
• Strict isolation Live todayyour data never informs another client’s work. The AI drafting context for your requests is assembled from your data only.

Our platform runs on Supabase (database) and Vercel (application), encrypted in transit and at rest — the same class of infrastructure behind most modern software you already use. We’re not “in-house” — and honestly, neither are the spreadsheets, form tools, and email your data lives in today. The real question is whose controls are stronger. Ours are listed on this page, and they’re verifiable. If a funder requires your data to live somewhere specific, tell us — we’ll structure around it, working only from coded or aggregate exports. We’d rather narrow scope than put your funding at risk.