Security

• Accounts are created only through an approved access request — there is no open sign-up.
• Sign-in is email-and-password or Google, handled by our managed authentication provider; we never store your password.
• Roles are held separately from user profiles, so a user cannot escalate their own permissions.
• Sign-in events are recorded so unexpected access can be spotted.

Every student, IEP, goal, session and recording row carries an owner. Row-level security policies in the database restrict reads and writes to the creating clinician, clinicians assigned to that caseload, and organization administrators. The rules are enforced by the database on every request, including requests made by the application itself.

• Session recordings and imported IEP documents are held in private storage, never in a public bucket.
• Files are reachable only through short-lived signed links issued to an authorized clinician.
• Recording and AI transcription require a per-student consent record to be tracked in the consent ledger. In the current release the ledger is informational: a missing consent does not block a session, but every AI-generated artifact produced without one is flagged for audit.

All traffic to the application is served over HTTPS. Data at rest is encrypted by our managed cloud database and storage providers.

Exports, disclosures, approvals and AI-output reviews are written to an append-only audit log with the acting user and timestamp. Audit entries cannot be edited or deleted from the application.

• Generated documents are drafts and are marked unapproved until a clinician reviews them.
• The original generated text is stored alongside the clinician's final text, so edits are visible.
• AI requests are rate-limited per user to contain runaway usage.

We secure the platform: access control, storage, encryption in transit and audit logging. Your organization is responsible for who you grant access to, for obtaining the consents required before recording a student, and for reviewing generated documentation before it leaves the workspace.

Report suspected vulnerabilities or a security incident to security@lumalayer.ai. We acknowledge reports within two business days and do not pursue researchers who report in good faith.