Security

Your test suite describes how your product is supposed to behave, which makes it worth protecting. This page sets out the controls Lumin gives you, the providers involved in running the service, and how to reach us about a security issue.

Access control

Every product you test gets its own Project, and Projects live under an Individual account or a shared Workspace. Within a Workspace, each person is assigned Admin, Member, or Reader access project by project, so read-only reviewers can see a suite without being able to change it. One email can belong to several Workspaces without their data mixing.

Sign-in and enterprise controls

Higher plans add the controls larger teams are usually required to have:

• SSO — sign in through your existing identity provider instead of a separate Lumin password, so offboarding someone in one place offboards them here too.
• Custom Roles — define permission sets that match how your organization actually divides responsibility.
• Audit Log — a record of who changed what and when.

Which of these your plan includes is listed on the pricing page.

Data in transit

Lumin is served exclusively over HTTPS, and this website sends a standard set of hardening headers with every response — including X-Content-Type-Options, X-Frame-Options, and a strict Referrer-Policy — so pages cannot be framed by another site or leak full URLs to third parties.

Providers we rely on

We keep the list of third parties that touch data deliberately short. For this website it is Microsoft Azure, which hosts it; Cloudflare Turnstile, which checks that a contact form submission comes from a person rather than a bot; SendGrid, which delivers the resulting email; Adobe Fonts, which serves the heading typeface; and Google Analytics, which sets cookies only if you consent to them. Each processes data on our behalf under its own security terms. Our Privacy Policy covers what each one receives.

Getting your data out

Nothing you put into Lumin is trapped there. Scenarios export as standard .feature files, the Label and Step Definition library imports and exports whole, and every plan includes the REST API. A tool you cannot leave is a risk in its own right.

Reporting a vulnerability

If you believe you have found a security issue in Lumin, email hello@lumintest.com with enough detail to reproduce it. Please report it to us before disclosing it publicly, and avoid running tests that could degrade the service or reach other customers' data. We will acknowledge your report and keep you informed while we work on it.

Questions from your security team

If you need to complete a vendor review, or want detail on hosting, data residency, retention, or subprocessors beyond what is on this page, get in touch and we will answer directly.