Security & trust

Security is foundational to LunaOne. This page summarises how we protect your data and isolate every customer.

US data sovereignty

LunaOne is hosted in the United States. Keeping your data under US jurisdiction is a core part of our privacy-first positioning.

Tenant isolation

Every organization’s data is isolated at the database layer with row-level security, enforced under a least-privilege application role — a query can only ever see its own tenant’s rows. External products that own their own data apply the same per-tenant scoping.

Authentication & access

Sign-in and organization management are handled by our identity provider (Clerk). External products are launched via a short-lived, signed handoff token verified against our published keys — no shared passwords, and access is gated on a live entitlement projection so a cancelled plan loses access.

Encryption

Data is encrypted in transit (TLS) and at rest. Payment details are handled by Stripe; we never store full card numbers.

Responsible disclosure

Found a vulnerability? Please email security@lunaone.ai with details and steps to reproduce. We investigate promptly and will keep you informed; please give us reasonable time to remediate before public disclosure.