Security and compliance

Who can do what#

Companies are isolated:

• every request is checked against the company's membership;
• a runner key belongs to one company;
• a run's token works only for that run and only while it runs.

Accounts and sessions#

• Sign-in: with your email (from 2.16.0; accounts made before keep their username). An email someone only typed never signs anyone in: a proven email (confirmed by its link) or the email an account was made with.
• Passwords:
  • at least 10 characters for a new one (from 2.16.0; older passwords keep working);
  • stored as bcrypt hashes;
  • reset with Forgot password? on the sign-in page (once email is set up), or from the command line (see Operations).
• Login attempts: at most 5 a minute per address. Set TRUSTED_PROXIES so the limit sees real addresses behind your proxy.
• Sessions:
  • last 7 days;
  • signed with SESSION_SECRET;
  • sent only over HTTPS (COOKIE_SECURE=true);
  • tied to the password, so changing it signs out other sessions.
• The setup token works only until the first account exists; the installer's link carries it after a #, so no server log keeps it. Invite links are for one email, expire after 7 days and work once; the company set-up link likewise, and it lets its manager make one company.

Secrets#

• Storage: company secrets (the OpenAI key, the webhook secret, the SIP trunk password, API tokens) are encrypted with SECRETS_KEY.
• Write-only: after saving, the page shows only a short hint, never the value.
• Agents never see secret values:
  • The server uses them itself, for voice, phone calls and the outbound trunk.
  • An admin can bind a secret to the agents whose server-side tools may use it.
  • With API requests, the server adds the secret to a request and sends it only to the hosts an admin allowed for that secret.
  • Changes to outside systems wait for an admin's approval in the Inbox.
• Logging: every use of a secret is logged.
• Secrets waiting for a value: a secret can arrive by name only, from a team package. Values never travel in packages.
  • It keeps its description, its allowed hosts and the agents that may use it, and shows Value needed in Settings → Secrets.
  • Admins get one Inbox item listing these secrets.
  • Until an admin enters the value, an agent that tries to use it gets a clear "has no value yet" answer, and voice says the OpenAI key is missing.
• Pairing and browser tokens are stored only as hashes.
• The Claude login token lives only in the runner's environment.

Outside data#

Everything that comes from outside the team is shown to agents as information, never instructions:

• caller speech and transcripts;
• WhatsApp messages;
• web pages from the office browser;
• CSV imports;
• integration endpoint calls;
• customer notes.

The agents' instructions say so, and the tools label it. A page or a message that says "ignore your rules and…" is just text to them.

What agents cannot do#

• No computer access: no shell, no file system access beyond the files shared with the run, and no web access other than the office browser.
• No new teammates on their own: they cannot create agents (a proposal waits for an admin).
• No settings changes: they cannot change settings, secrets or permissions.
• No customer messages on their own: they cannot message a customer without a person, except when a manager asked them to in that conversation.
• No secret fields: they cannot type passwords, payment details or files in the browser, or open the office network.
• No changes on read-only sites: they cannot change anything on sites that are not on the allowed list.

Calling rules by country#

A company's country (Settings → Departments) sets the rules its calls follow; its departments do not change them.

The rules below are the UAE's.

Calls (UAE and KSA)#

There is no "cold call" basis in Lumate. One would be added only after a lawyer's written sign-off.

Before outbound calling starts, a lawyer must sign off on the call scripts, cold-calling rules, recording and monitoring disclosure, and marketing messages, in the UAE (TDRA, DLD rules for brokers) and KSA. Lumate's defaults are conservative, but they are not legal advice.

WhatsApp#

• The session is encrypted with WHATSAPP_STATE_KEY, and message texts never appear in logs.
• Messages go out only when a person sends them, or when a manager asked an agent to.
• Pace limits protect the number: 30 an hour, 200 a day, 15 per customer a day.
• Voice notes (from 2.14.0) go to OpenAI only to be written out, on the company's own key; a Personal chat's never do, the audio is deleted afterwards, and Settings → WhatsApp → Write out voice notes switches it off.

LinkedIn#

LinkedIn's User Agreement (section 8.2) does not allow bots or scraping. Agents go at a person's pace there (a page every 10 seconds at most, 40 an hour, 150 a day), a person approves every click, typing or choice (for that page, that conversation and that element only), and LinkedIn's own security check stops every agent there for a day. See Office browser.

Search#

The search index lives in Lumate's own database, and meaning search runs on the machine (intfloat/multilingual-e5-small, MIT licence, fetched once from huggingface.co at a pinned revision and checked by SHA-256): no text is sent anywhere for search. Fields marked sensitive, and formulas that read them, are never written into the index. Access is checked on every search from the same rules the pages use.

Claude Code updates#

Runners install a Claude Code release only when its manifest is signed by Anthropic's release key (pinned in the code by fingerprint) and the binary matches the manifest's SHA-256 and size. The copy installed with Lumate stays as a floor; a version whose first runs fail is left for the one before.

OXS Cloud and the licence#

Lumate runs with a licence from OXS and checks in with OXS Cloud every 12 hours. A check-in carries counts and codes only (its version, edition, how many companies, people, agents, calls and messages, the database's size, how updates went) and never anything a company keeps: no names, numbers, messages, transcripts, files or prompts. The exact fields are in Licensing, and Settings → Licence shows the last check-in as it was sent. An ended licence never deletes or holds back data: Export all data works in every state.

Linked PCs#

From 2.15.0, an office PC running Lumate in connect mode can be linked to a company on the server edition:

• Who links: only an owner or admin of the company, by approving the code the PC shows (10 minutes). The approval shows the address the request came from: approve only a PC in front of you that shows the code, never a code someone sends you or reads to you on the phone. Codes, the PC's poll secret and its token are kept as hashes; the token is kept on the PC in Windows' vault (DPAPI). Settings → Linked PCs lists the PCs; Unlink (there, or on the PC) ends the PC's token and closes its connection at once, and the PC lets go of the desk phone line.
• What the PC obeys: SIP addresses and numbers from the server are refused when they hold spaces or control characters, so nothing the server sends can add to what the PC sends the PBX. A PC whose link is gone for a minute lets go of the PBX until the server sets the line up again.
• What the PC receives: the commands for the office browser's pairing (a one-time code) and for the desk phone line, including that line's SIP password, kept in the PC's memory only while the line runs. It never receives the OpenAI key, agents' instructions, tools, customers or messages: the voice session and the agents' work stay on the server.
• Where the PC connects: only to the one server address saved in its app (https with a publicly trusted certificate). A pairing for any other address is ignored.
• The connection: outgoing from the PC (a WebSocket over HTTPS); no port is opened in the office. The calls' audio goes over it encrypted; on the office network, between the PC and the PBX, it is as on any desk phone (not encrypted).

Diagnostics (from 2.16.0)#

• Kept on the install: every error Lumate logs is counted by its kind (the exception's class) and its place in the code (module, function, line), per day, for a week. Neither the log line's text nor the error's own words are kept: either can carry a name, a number or a message's words.
• Sent to OXS only on a click: an instance admin (Server page) or a company's owner or admin (Settings → Status) presses Send diagnostics to OXS after seeing the preview, and exactly what the preview showed goes. It carries the version, the system, each part's state (companies by number), those error counts and the admin's own note. Both sides check each field's shape (a state's words carry no address or line break; a place in the code is module:function:line), and OXS Cloud refuses anything outside that list, at most 64 KB and ten a day per install. OXS support staff open one in the console, and each opening is in OXS's audit log; read ones are deleted after 90 days, any after 180. A support inbox, when OXS has one, hears that diagnostics came, never what they say.
• Without OXS: Download file gives the same content to send any other way.

The person who installs Lumate (from 2.16.0)#

On a server, the first account runs the server. When they hand the company's set-up to a manager ("Someone else"), they are not a member of that company and Lumate does not let them in as the instance admin: they see its name only. Their place is the Server page (status, diagnostics, updates, backups, the licence). They still hold the server itself, and with it its backups and its data on disk: choose who installs accordingly. A handed-over first company's mailbox is the manager's, so the installer's own password reset never goes through it: they reset it on the server.

Data#

• Location: everything is in the server's data volume, plus the WhatsApp worker's volume. The office browser's logins stay on the office PC.
• Activity log: every change by people and agents is in it.
• Cards are kept until a person deletes one. Agents move cards to Done or Declined and never delete one. An owner or an admin deletes a card from the card, with what Lumate keeps about the person: its history, its thread and the tasks under it with their documents, appointments and call list places, the calls with them (their transcripts), their WhatsApp messages, the notices about them and their WhatsApp copies, the LinkedIn changes asked about them, what outside systems (a CRM) sent about them, the lessons drawn from their calls and the files on the card. The activity log keeps that things happened, without the details that named them. Other tasks and chats that mention the person stay (with the agents' records of their work there), and so do what agents remembered and a file another card or task also holds. A number that asked not to be called stays on the do-not-call list. The sample customers are removed together (Customers → ⋯).
• Retention (Recruiting): on the first of each month Lumate lists the rejected candidates with nothing new for 12 months, for a person to delete (see Recruiting).
• Backups: see Operations. A backup includes customer data, so store it encrypted.