Trust

Trust and data handling.

What Netlumi can read, what it keeps and for how long, where it is kept, how a fix reaches you, where the audits stand, and what happens when you leave. The same facts, in more detail, are on the Security & Privacy page in the app.

SOC 2 Type I and ISO 27001: in progress. Security & Privacy page

Read-only access, exactly.

Netlumi has no write access to your cloud. The permissions below are what the onboarding creates; the full AWS template is published, and the disclosure policy covers anything that grants more than it says.

AWS: A role you create from a published template, with the AWS-managed SecurityAudit policy plus Netlumi policies that grant exactly the read actions Netlumi calls. It does not use ReadOnlyAccess. Deny policies in the same stack stop it reading your data: S3 objects (other than IaC state), DynamoDB items, log events, queue messages and stream records, query results, repository files, and secrets or parameters through KMS. It cannot issue credentials or tokens. Netlumi assumes the role with an external ID for credentials that expire after one hour, and stores no access keys.
The template: netlumi-aws-onboarding-stack.yaml. The one write: for AWS Organizations onboarding, a setup role deploys the read-only role to member accounts and stops working after 7 days.
Azure: A federated credential, with no client secret. A custom role, Netlumi Security Reader, with read actions only and no Key Vault secret values, no storage account keys and no VM extension settings. An optional What-If role lets Netlumi preview and validate a proposed fix; it cannot deploy.
Google Cloud: Workload identity federation to a service account with no keys. The roles Cloud Asset Viewer, Security Reviewer and Service Usage Consumer, and optionally object reads on the named buckets that hold your IaC state. Netlumi never asks for the Viewer role, which can read object data.
GitHub: Two apps. The read app asks for metadata, contents and pull requests, read-only. The fix app adds write access to contents and pull requests so it can open fix pull requests, on the repositories you choose. Tokens are minted for one repository at a time and last at most an hour. Netlumi pushes only to branches named netlumi/fix-* or netlumi/advisory-*, never to your default branch, and never merges.

What we store, for how long, and where.

Hosted on AWS in the USA (us-east-1), encrypted in transit and at rest, with a key per tenant that is destroyed first when your tenant is deleted.

Findings and inventory: What Netlumi finds in your cloud accounts and repositories, the attack paths and the fixes, kept while the account or repository is connected (see leaving, below).
Your code: Working copies of connected repositories on the scanning hosts’ encrypted disks, for as long as the repository is connected; deleted within an hour of disconnecting. Netlumi’s search index does not keep the text of your code. A proposed fix is kept until its pull request is opened, and at most 30 days. Fix and validation caches, up to 8 days.
Secrets: A secret Netlumi finds is recorded by name, kind and a short fingerprint, never in full. IaC state files are read in memory and not kept; sensitive attributes are removed before anything derived from state is saved.
The free scan: The code is downloaded into a temporary, isolated environment that is destroyed when the scan ends. The report, with short excerpts and secrets masked, is kept for 90 days.
Logs: Service logs record identifiers, sizes and hashes, never code, and are kept for 30 days.
Backups: A backup of the tenant key table is kept for up to 35 days to recover from accidents, so a deleted key is gone from every copy within 35 days.

AI providers and training.

Training: Netlumi does not use your data to train AI models, and uses AI providers under terms that do not allow them to train their models on it.
Stated in the terms and the data processing agreement.
What a provider sees: To write a fix, a provider sees the finding, the proposed change and its code context, with keys, tokens, passwords and secret-looking values masked; Netlumi puts the originals back locally. To answer a Lens question, a provider sees the question with the findings and inventory it needs. Which providers, and what each receives, is listed under Subprocessors on the Security & Privacy page.
Netlumi never reads prompts: For your own AI agents, Netlumi reads configuration and your cloud’s own activity records. It never reads or stores your agents’ prompts, responses or conversations; the runtime gate receives the tool call, not the prompt.

How fixes work.

Pull request only. You merge; Netlumi never does.

The pull request: Netlumi writes the fix in the IaC code that created the resource and opens a pull request on a netlumi/fix-* branch. In review mode, the default, nothing is written to your repository until you approve the fix. Netlumi never pushes to your default branch and never merges.
Planned, never applied: Where it can, Netlumi plans the change against your real state, in an isolated environment with your read-only credentials. A failed or skipped plan never yields a pull request. Nothing is ever applied.
Re-checked: After the fix is planned, the finding is checked again against the planned change. If it is still there, no pull request is opened. The pull request says what was checked and what was not.
Never destructive: A fix that would destroy or replace a resource is blocked.

A sample finding and a sample fix pull request

Audits and testing.

SOC 2 and ISO 27001: SOC 2 Type I and ISO 27001: in progress. Netlumi has no SOC 2 report yet, and no ISO/IEC 27001 certificate has been issued yet. We run an information security management system aligned to ISO/IEC 27001:2022 Annex A: an information security policy, access control, incident response and business continuity plans, a risk register, vendor management and a statement of applicability. We can walk you through it and answer security questionnaires on request. We will publish the reports on the Security & Privacy page when they are issued.
Penetration testing: An external penetration test of Netlumi has not been carried out yet. It is on our audit plan for the fourth quarter of 2026. The responsible disclosure policy below applies in the meantime.
Sign-in: Single sign-on (SAML and OIDC) on the Enterprise plan, rolling out, with multi-factor break-glass accounts. Support access by Netlumi staff to a customer account is read-only, time-limited and audited.
Frameworks in the product: The frameworks named in the product (CIS Benchmarks, SOC 2, ISO/IEC 27001, PCI DSS and others) are Netlumi’s mapping of your findings. They are not an audit of you or of Netlumi.

When you cancel or leave.

Your plan: A paid plan runs to the end of the period you have paid for, then your account moves to the free plan. There is no cancellation fee. Nothing is deleted when a plan ends or a trial ends.
A cloud account: Leaving a cloud account means removing the Netlumi role or stack from it. Netlumi keeps the data about that account for 30 days, so reconnecting restores everything, and purges it after that. Owners are told the purge date. If another organisation takes the account over, your organisation’s data about it is removed at once.
Your whole organisation: On request, Netlumi deletes your users, accounts, findings, search index entries, fixes and settings. Your tenant key is destroyed first, so every fingerprint becomes meaningless and anything sealed with the key, including a backup, can no longer be read. Deleted data is removed from backups within 35 days.

Write to [email protected] for a deletion or a data processing agreement, or to [email protected] for anything else.

Responsible disclosure.

If you believe you have found a security problem in Netlumi, tell us privately first and give us a reasonable time to fix it. We will work with you in good faith.

Where: Email [email protected]. The policy is at app.netlumi.com/security/disclosure and named in security.txt.
In scope: The app and this site, the APIs they call, the free scan, the two GitHub apps, the onboarding templates and scripts, and isolation between customers.
What to expect: An acknowledgement within 3 business days, our assessment within 10 business days, updates at least every 14 days, and a fix as fast as the severity requires: we aim for 30 days for critical and high issues and 90 days for the rest. Credit on request. Good-faith research that follows the policy is authorised; we will not take legal action over it.
Rewards: Netlumi does not run a paid bug bounty yet. We are glad to thank and credit you publicly, with your permission.