Trust & Security
What Lumenbase protects and recovers, and where workspace admins manage it in the app.
Frequently asked questions
How does Lumenbase protect my CRM data?
Each workspace is a separate tenant with database-enforced isolation, encrypted connections and storage, role-based access, optional mandatory 2FA, and Security Center logging for exports and sensitive changes.
Can I recover deleted CRM data without contacting support?
Yes. Admins restore deleted records from Trash & Recovery, undo bulk deletes, restore a time range, roll back imports, and restore workspace snapshots in System Operations, Data Hub, Recovery.
Does Lumenbase sell my CRM data?
No. You own your CRM data; Lumenbase processes it on your instructions as your processor under our Terms and DPA. We do not sell CRM data.
Is Lumenbase SOC 2 or ISO 27001 certified?
Lumenbase is not SOC 2 or ISO 27001 certified, and is not HIPAA compliant. The Data Processing Agreement is published at lumenbase.io/legal/dpa. Send security questionnaires to security@lumenbase.io.
Is my CRM data encrypted?
Yes. Data is encrypted in transit and at rest. Sign-in tokens for connected apps are encrypted too.
Is Lumenbase GDPR and CCPA compliant?
Lumenbase supports GDPR and CCPA rights. The DPA and subprocessor list are published, privacy requests go through lumenbase.io/legal/privacy-requests, and transfers out of the EU use Standard Contractual Clauses.
Where is my CRM data hosted?
The main database runs in the EU (Ireland). Some subprocessors, such as payments and email, work in other regions. The list at lumenbase.io/legal/subprocessors names each provider, purpose and region.
Was this article helpful?