What we do with your data.
We're a small working company building production systems for paying clients. We've taken the practices that matter at our scale seriously, and we've been honest below about the certifications we don't have. If you need something we don't list, talk to us — we'll either scope around it or tell you to use someone else.
Platform console
Section
- Open requests2
- Urgent1
- Redacted events11
Customer content is withheld and marked, never blanked. A support request is written to us, so it is shown.
Matches a workspace's name, its slug or a member's email.
Practices we run today
- Identity
- Clerk handles sign-in and account security, including two-factor authentication. We never see or store your password. Staff access comes from a role set on the staff member’s Clerk account and is checked on the server.
- Hosting
- The site and the apps deploy on Vercel, with server functions in the US East region. Customer data lives in Supabase (Postgres), also in US East.
- Encryption in transit
- Every connection is HTTPS, with TLS terminated by the hosting platform. Production responses send a two-year HSTS header, so browsers refuse to fall back to plain HTTP.
- Encryption at rest
- Supabase encrypts the database and file storage at rest. Card payments are handled by Stripe, and full card numbers never reach our servers.
- Desktop app
- StackIDE, the Stacklumen desktop app for Mac and Windows, is optional: Terminal and the Hub run in the browser. Mac builds are signed with a Developer ID and notarised by Apple; Windows installers are not code-signed yet, so SmartScreen may warn. The app stores its session encrypted on the computer, with a key the operating system keeps, and reads and writes files only in folders you choose. How StackIDE is signed and what it stores
- Access control
- Customer data tables are moving to Postgres row-level security, table by table. Anonymous access to tables is revoked by default and granted back only to the few public surfaces that need it, such as recording a cookie choice.
- Audit log
- When staff open the platform console or inspect a customer workspace, the visit is recorded with who, which workspace, the path and the time. The console withholds customer content from staff views and marks where it did.
- Sub-processors
- Vercel (hosting), Supabase (database and storage), Clerk (sign-in), Stripe (payments), Resend (transactional email), Mailchimp (newsletter and download sign-ups) and Printful (merchandise orders). Analytics are first-party and stored in our own database; there is no third-party analytics or error-reporting processor.
Reporting and response
- Vulnerability reports
- Email support@stacklumen.com with "SECURITY" in the subject. We acknowledge within one business day and ship a fix or mitigation within seven days for high-severity issues.
- Incident response
- If an incident affects your data, we tell you within 72 hours of confirming it: what happened, what it touched and what we changed.
- Data deletion
- Email us and we delete your account-identifying data within 30 days, complete the deletion across primary databases and routine backups within 90 days, and confirm in writing.
What we don't have (yet)
What buyers sometimes ask for that we cannot provide today.
- SOC 2
- Not certified, and no audit is scheduled. We will explain in writing how any control on this page works.
- SSO / SAML
- Not offered. Everyone signs in through Clerk as described above.
- HIPAA / BAA
- Not currently available. We can scope an engagement to avoid PHI; talk to us if you need a BAA.
- Penetration testing
- No third-party penetration test report yet. Testing is internal.
- Windows code signing
- StackIDE’s Windows installers are not code-signed yet, so SmartScreen may warn the first time. Each installer’s SHA-256 fingerprint is listed beside it, so a download can be checked before it runs. The downloads
Email a human, get a real answer.
No legal-team gatekeeping and no two-week wait. We answer security and procurement questions within one business day, in writing, signed by name.