Trust & Security

Your ESG data, secure by design

LUMEA ESG processes sensitive financial and extra-financial data for asset managers and institutions. Here is, in full transparency, how we host it, encrypt it and control access to it.

Last updated · 7 August 2026

Our commitments

How we protect your data

Hosting & data residency

Your account data and your ESG data are hosted and stored within the European Union — datacenters in Germany and Finland.
The application, database and compute run on our own dedicated infrastructure, with a European hosting provider governed by European Union law.
Our servers run in datacenters certified to ISO/IEC 27001 (information security) — a certification held by our hosting provider.
No customer data is stored outside the EU. Some transient processing (AI analysis, CDN delivery, emails, payments) does rely on providers located outside the EU, under contractual safeguards — see our sub-processor list.
The datacenters that host us are powered by renewable electricity, per the environmental policy our provider publishes.

Encryption

All traffic is encrypted in transit via TLS/HTTPS.
Access to production systems is restricted and logged.

Authentication & access control

Multi-factor authentication (MFA) is available on every account: a TOTP second factor can be enrolled from the account settings and, once enrolled, is required at every sign-in. It is not enforced by default — an account without a second factor remains accessible by password or single sign-on (SSO).
Single sign-on (SSO) with Google and Microsoft.
Data access follows the principle of least privilege.
Login endpoints are protected against brute-force attacks (rate limiting).

Application security

Security headers are applied to every server response.
Sessions are managed securely, with full sign-out and context reload.
Data is partitioned per organisation.

Payments

Payments are processed exclusively by Stripe, PCI-DSS Level 1 certified.
LUMEA ESG never stores your card details.

Backups & continuity

Automated, encrypted backups, replicated to a second datacenter within the European Union (geo-separation).
The restore procedure is documented and tested.
Continuous infrastructure monitoring (availability, resources, incidents).

Privacy & GDPR

Data processing compliant with the GDPR, with EU hosting.
We are preparing a data processing agreement (DPA) that we will be able to sign with our customers.
Exporting your personal data and deleting your account are done directly from Settings → Account, without writing to us; the other rights (rectification, objection, restriction) are exercised by contacting us.

Transparency

Our sub-processors

Your account data and your ESG data are stored in the EU. The providers below operate on precise scopes; some operate outside the EU for transient processing.

Provider	Purpose	Region
Hetzner	Hosting of the application, database, compute, files and encrypted backups	Germany · Finland (EU)
Vercel	Residual scheduled jobs and rollback standby (being retired)	United States / global
Resend	Transactional email delivery	United States
Qonto	Invoice and payment-link issuance (customer billing)	France (EU)
Yousign	Electronic signature of customer contracts (signatory name and e-mail)	France (EU)
Stripe	Payment processing (PCI-DSS Level 1)	United States / EU
Anthropic (Claude)	AI analysis of ESG documents; conversational AI assistant (model of your choice)	United States
Google (Gemini)	AI analysis of ESG documents; conversational AI assistant (model of your choice)	United States
OpenRouter	Routing of AI calls to the host serving the selected model — submitted content reaches that upstream host	United States, then a per-model upstream host
DeepSeek	Conversational AI assistant and data-conflict resolution (DeepSeek models)	China
Z.AI (Zhipu AI)	Conversational AI assistant and extraction (GLM models)	China
OpenAI	Conversational AI assistant (GPT-5 model, your choice)	United States
Mistral AI	Document character recognition (OCR); conversational AI assistant (model of your choice)	European Union
LlamaIndex (LlamaParse)	PDF document extraction and conversion	United States
Web-search providers (Serper, Exa)	Execution of document-search queries	United States

Some optional integrations (Microsoft 365 / Google Workspace) only process data (name, email address and job title from your directory) if you explicitly enable them for portfolio synchronisation.

Security review

A security or compliance question?

We gladly answer our customers' and prospects' security questionnaires, and can make a data processing agreement (DPA) available on request.

Contact our security team Request a demo

LUMEA ESG