LUMEA ESG
    FeaturesHow it worksSecurityPricingIntégrationsRoadmapRequest a demo
    FeaturesHow it worksSecurityPricingIntégrationsRoadmap
    Request a demo

    Trust & Security

    Your ESG data, secure by design

    LUMEA ESG processes sensitive financial and extra-financial data for asset managers and institutions. Here is, in full transparency, how we host it, encrypt it and control access to it.

    Last updated · 7 August 2026

    Our commitments

    How we protect your data

    Hosting & data residency

    • Your account data and your ESG data are hosted and stored within the European Union — datacenters in Germany and Finland.
    • The application, database and compute run on our own dedicated infrastructure, with a European hosting provider governed by European Union law.
    • Our servers run in datacenters certified to ISO/IEC 27001 (information security) — a certification held by our hosting provider.
    • No customer data is stored outside the EU. Some transient processing (AI analysis, CDN delivery, emails, payments) does rely on providers located outside the EU, under contractual safeguards — see our sub-processor list.
    • The datacenters that host us are powered by renewable electricity, per the environmental policy our provider publishes.

    Encryption

    • All traffic is encrypted in transit via TLS/HTTPS.
    • Access to production systems is restricted and logged.

    Authentication & access control

    • Multi-factor authentication (MFA) is mandatory on every account.
    • Single sign-on (SSO) with Google and Microsoft.
    • Data access follows the principle of least privilege.
    • Login endpoints are protected against brute-force attacks (rate limiting).

    Application security

    • Security headers are applied to every server response.
    • Sessions are managed securely, with full sign-out and context reload.
    • Data is partitioned per organisation.

    Payments

    • Payments are processed exclusively by Stripe, PCI-DSS Level 1 certified.
    • LUMEA ESG never stores your card details.

    Backups & continuity

    • Automated, encrypted backups, replicated to a second datacenter within the European Union (geo-separation).
    • The restore procedure is documented and tested.
    • Continuous infrastructure monitoring (availability, resources, incidents).

    Privacy & GDPR

    • Data processing compliant with the GDPR, with EU hosting.
    • We are preparing a data processing agreement (DPA) that we will be able to sign with our customers.
    • You can exercise your rights of access, rectification and erasure by contacting us.

    Transparency

    Our sub-processors

    Your account data and your ESG data are stored in the EU. The providers below operate on precise scopes; some operate outside the EU for transient processing.

    ProviderPurposeRegion
    HetznerHosting of the application, database, compute, files and encrypted backupsGermany · Finland (EU)
    VercelResidual scheduled jobs and rollback standby (being retired)United States / global
    StripePayment processing (PCI-DSS Level 1)United States / EU
    ResendTransactional email deliveryUnited States
    Anthropic (Claude)AI analysis of ESG documents; conversational AI assistant (model of your choice)

    Security review

    A security or compliance question?

    We gladly answer our customers' and prospects' security questionnaires, and can make a data processing agreement (DPA) available on request.

    Contact our security teamRequest a demo
    LUMEA ESG

    The transparent ESG analysis platform. Verified data, scoring on your own terms.

    Product

    • Features
    • Pricing
    • API

    Resources

    • Roadmap
    • Documentation
    • API reference

    Contact

    • Request a demo

    © 2026 LUMEA ESG. All rights reserved.

    Legal noticePrivacy policyCGVDPATrust & Security
    United States
    Google (Gemini)AI analysis of ESG documents; conversational AI assistant (model of your choice)United States
    OpenAIConversational AI assistant (GPT-5 model, your choice)United States
    LlamaIndex (LlamaParse)PDF document extraction and conversionUnited States
    Mistral AIDocument character recognition (OCR); conversational AI assistant (model of your choice)European Union
    Web-search providers (Serper, Exa)Execution of document-search queriesUnited States

    Some optional integrations (Microsoft 365 / Google Workspace) only process data (name, email address and job title from your directory) if you explicitly enable them for portfolio synchronisation.