Policy
Privacy Policy
What we collect on this site and in the product, the legal bases, retention and your rights under the GDPR and LGPD.
ReadTrust Center
Trust Center
What Lustena stores, where it runs, who processes it, how long it is kept, and the honest status of every certification.
Policies and practices
Every document about how Lustena handles your data, in one place.
Policy
Terms of Service
The terms under which Lustena provides the platform, the extension, the SDK, the MCP server and the scanner.
ReadPractice
Security
Content-free by default, tenant isolation in code, encryption, retention and audited reads.
ReadPolicy
Vulnerability Disclosure
How to report a vulnerability, what to expect, and the rules that keep research safe.
ReadData handling
What the sensors send, what the platform keeps, and who can read it.
What leaves the device
Findings: categories, counts, destinations, channels and HMAC fingerprints, with identifiers and category codes. Heartbeats: sensor and catalog versions, adapter status, message counts. Session events: derived ids, turn numbers, channels. Never prompt text, file contents, file names, page titles or raw conversation ids.
What is stored
Findings, devices, sessions, agents, limits, scan reports and audit rows per workspace. Redacted turn content only when a workspace opts in, at the redaction level it chooses, encrypted at rest, with its own retention.
Who can read it
Workspace members by role. Redacted content only by admins through a user session, never by an API or device token, with every read audited.
Redaction levels
Content capture is off by default. When a workspace turns it on, with a written lawful basis, every detected value is replaced by its category on the device, at the level you choose.
Typed in the AI app
Send the renewal to ana.souza@client.com.br, CPF 123.456.789-09, key sk-live-9f2c…
What leaves the device · level 2
Send the renewal to [EMAIL], CPF [CPF], key [API_KEY]
Level 1
Secrets
API keys, JWTs, private keys and card numbers are replaced before anything leaves the device.
[API_KEY] · [JWT] · [CARD]
Level 2
Personal data
Everything in level 1, plus CPF, CNPJ, RG, CNH, CNS, CEP, email and Brazilian phone numbers.
[CPF] · [EMAIL] · [PHONE]
Level 3
Strict
Everything in level 2, plus any long number, URL or code-like identifier, for teams that handle regulated data.
[NUMBER] · [URL] · [ID]
Transparent to employees
People can see what Lustena records about them. Monitoring nobody can inspect is a liability; this is the opposite.
What they can see
The extension's findings page lists every finding recorded on that device, whether the device is enrolled or in local mode, and whether content capture is on.
What admins can exclude
Apps and sites can be excluded from observation for the whole workspace or for one team, so Lustena only looks at AI use.
What they can ask
An employee can ask for their records to be deleted. The workspace admin handles it, and Lustena deletes them within 30 days.
Subprocessors
The services that process customer data on Lustena's behalf. Changes are published here and sent to workspace admins at least thirty days in advance.
| Provider | Purpose | Region |
|---|---|---|
| Google Cloud | Platform API on Cloud Run and managed Postgres | United States (us-central1) |
| Supabase | Authentication and workspace data | United States |
| Vercel | This website | Global edge |
| Resend | Transactional email | United States |
| Sentry | Error monitoring, no content | United States |
| PostHog | Product analytics, no content | United States |
Certifications and frameworks
Current status, stated plainly.
SOC 2 Type II
In progress. Controls are being documented against the SOC 2 criteria, in preparation for the audit.
Status: in progress
ISO/IEC 27001
In progress. The information security management system is being documented against the standard, in preparation for certification.
Status: in progress
GDPR and LGPD
Designed for both: content-free by default, lawful basis recorded before any capture, retention limits, audited access, deletion on request.
Status: by design
EU AI Act
Evidence for risk classification, an inventory with an owner for every agent, logging and human oversight for each agent customers run.
Status: evidence mapped
ISO/IEC 42001
Evidence mapped for customers' AI management systems: a governed agent inventory, declared limits and a decision history per agent.
Status: evidence mapped
NIST AI RMF
Govern, map, measure and manage, with fleet-wide visibility, per-agent evaluation and runtime alerts.
Status: evidence mapped
AIUC-1
Evidence across the six domains, organized for an independent assessment of the agents customers run.
Status: evidence mapped