Security & Data Protection

An overview of how Lumos Logic HRMS is designed to protect your organization's data.

We design Lumos Logic HRMS with security in mind. This page describes the security practices implemented in the platform. We do not claim any third-party security certification, and this page should not be read as a guarantee of absolute security.

Last updated: October 3, 2026.

  • Hashed passwords: Passwords are stored using one-way hashing, never plain text.
  • Token-based sessions: Authentication uses signed JSON Web Tokens (JWT) with expiry.
  • Role-based access: Granular permissions per module, role and organization.
  • Tenant isolation: Data is separated per organization (multi-tenancy).
  • Rate limiting: API requests are rate limited to reduce abuse.
  • Ongoing updates: Regular maintenance and security fixes.

1. Authentication & Access Control

  • Access to the Service requires authentication with a work email and password.
  • Passwords are stored as one-way hashes (bcrypt); we cannot view your plain-text password.
  • Organizations may optionally enable two-factor authentication (2FA / TOTP) for added account protection.
  • Sessions are issued as signed JSON Web Tokens with a limited lifetime.
  • Login and general API access are rate limited to reduce brute-force and scripted abuse.

2. Authorization & Data Isolation

Role-based access control (RBAC)

The platform enforces a role hierarchy (employee, HR, Root) with a configurable permission matrix. Users only see and act on the modules their role and permissions allow.

Organization / tenant isolation

Each organization’s data is separated and scoped by organization. Access checks are applied to data queries so that a user cannot read or modify another organization’s records.

Branch scoping

Where an organization has multiple branches, administrators can be scoped to specific branches so their access is limited to the workforce they manage.

3. Secure Communication & API

  • All traffic to the web and mobile applications is served over HTTPS.
  • API requests are authenticated with bearer tokens, and cross-origin requests are restricted to known origins.
  • Biometric device endpoints are protected by rate limiting and a device/IP allow-list, with access logged.

4. Data Protection

  • Core application data is stored in a PostgreSQL database with organization-level separation.
  • Uploaded files (documents and receipts) are stored with a third-party cloud storage provider over secure connections.
  • Email is delivered through a shared SMTP service; credentials are kept in server environment configuration, not in application code.

5. Monitoring, Logging & Security Updates

  • Server and request logs are used for security monitoring and troubleshooting.
  • Sensitive administrative actions (for example, biometric device activity and platform activity) are logged for audit.
  • We apply security fixes and platform updates on an ongoing basis.

6. Report a Security Concern

Found a vulnerability?

If you believe you have discovered a security issue or experienced an incident involving Lumos Logic HRMS, please report it to hello@lumoslogic.com.

  • Describe the issue in as much detail as you can.
  • Include steps to reproduce, where possible.
  • Do not include live passwords, API keys or other credentials.
  • Do not publicly disclose a suspected vulnerability before we have had a chance to respond.

7. Related Pages

  • Privacy Policy — how we handle personal information.
  • Contact & Support — how to reach us.
  • Cookie Policy — cookies and similar technologies.

This page describes current practices and may be updated as the platform evolves.