Trust Center · Security
Lustena is built to be audited. It does not yet hold certifications of its own and will not print a badge it did not earn. What it does hold is a design where, by default, the most sensitive data never leaves the device, and a codebase where tenant isolation is enforced on every request.
The browser extension records only categories, counts, destinations, channels and HMAC fingerprints. By default, prompt text, file contents and file names never leave the device; opt-in capture sends redacted text only.
Agent SecurityEvery read takes a verified principal and goes through a tenant-scoped repository. Device tokens can do nothing but post findings and heartbeats for themselves.
Data handlingOpt-in redacted content is encrypted at rest with a per-row key id, has its own retention of up to 365 days, and every read writes an audit row.
Subprocessors