Legal
Security
Last updated 2026-07-05
This document is a plain-language draft prepared for launch. It has not yet been reviewed by outside counsel — treat it as representative of our practices, not as finalized legal advice.
A summary of the practices we follow to keep your account, your students’ data, and your recordings safe.
Account access
- Passwords are never stored by us in plain text — authentication is handled by Supabase Auth using industry-standard hashing.
- Sign-up on public forms is protected by Cloudflare Turnstile (bot/abuse prevention) and rate limiting.
- Account activation links are single-use, expire after 72 hours, and are matched by a cryptographic hash — the raw link is never stored.
Room access
- Every room has a private, unguessable link. Knowing the link doesn’t grant entry — a tutor must admit each participant (“knock to enter”).
- Video and audio tokens are minted server-side and scoped to a single room; a participant can’t access another room’s media.
- Database access is governed by row-level security policies, enforced on every read and write — not just in the app’s UI.
Data in transit and at rest
- All traffic between your browser and LumenBoard is encrypted (HTTPS/WSS).
- Recordings are stored in Cloudflare R2 with access restricted to our servers — recordings aren’t publicly listable or guessable.
- Billing is handled entirely by Stripe; LumenBoard never receives or stores your full card number.
Internal access
Staff access to account or session data is limited to what’s needed to provide support, and every privileged action (account removal, org creation, data export) is written to an append-only audit log.
Reporting a security issue
If you believe you’ve found a security vulnerability, please email security@lumenboard.net with details. Please don’t publicly disclose an issue before we’ve had a chance to address it — we’ll acknowledge your report and keep you updated as we investigate.