Security
How your data moves.
Lumate runs on your PC or your server. Two AI services do the thinking and the talking, on your own accounts. Here is what each one receives, and what never leaves.
In short
- Your contacts, chats, call transcripts and files stay on your machine. Lumate keeps no call recordings.
- Claude (Anthropic) does the agents' thinking, with text only. OpenAI's GPT-Live is the voice on calls. Both run on your accounts.
- Each request carries only what that piece of work needs, within limits set in the code. Neither service gets the database.
- Nothing about your customers reaches OXS. The licence check sends counts, never names, numbers or messages.
- Under business terms neither provider trains on this data. A personal Claude plan follows that account's own privacy setting.
What each service receives
| Data | OpenAI (the voice) | Claude (the agents) |
|---|---|---|
| Call audio | The whole call, both sides, live. Lumate records nothing. | Never |
| Name and phone number | On a call with that person, in the call brief | Yes |
| What they are looking for | A one-line summary and the card's notes | Yes |
| Earlier calls | At most two earlier calls' outcomes | The newest transcripts, for the customer's agent |
| WhatsApp messages | Voice notes only, to be written out (from 2.14.0; switch off in Settings) | The customer's own chat |
| Chats labelled Personal | Never | Never |
| Files and documents | Not on customer calls | Only files attached to that chat or agent, when an agent opens one |
| Passwords, keys and secrets | Never | Never: agents see secret names only |
What reaches OXS
Every 12 hours the licence check sends the install's id, version and edition, and counts such as calls today and users. Settings → Licence shows exactly what was last sent.
Lumate sends email through your company's own mailbox (Microsoft 365, Google Workspace or your own server). OXS sees none of it.
Search
The search that finds things by meaning runs on your computer; no text leaves it.
Updates
Every installer and update is signed with Lumate's release key. A server backs up before an update and goes back by itself if the new version does not start.
Your control
Export all data at any time, even after a licence ends. Deleting a contact removes it from Lumate.
The full detail, field by field, is in the guide: Security and compliance