Clear Security, Data Privacy & Infrastructure Boundaries
Liulum protects tenant data, customer credentials, and production reliability above feature speed. We publish exact subprocessors, data encryption standards, retention policies, and non-negotiable security boundaries.
Credential Scoping & Encryption
Customer API tokens and webhook secrets are encrypted at rest using AES-256-GCM. Integration credentials are scoped to the minimal required permissions (e.g. read-only metadata or specific PR creation) and can be revoked instantly.
Data Isolation & Retention
Every event and evidence snapshot is tenant-isolated. Evidence history is retained based on plan tier (30 days for Watch, 90 days for Continuity, 180 days for Recover). Expired data is purged daily via automated retention sweeps.
Control-Plane Independence
Liulum is monitored externally from outside its primary control plane. System health status is served independently and will never display a false healthy state during partial infrastructure degradation.
Current Subprocessor Directory
| Subprocessor | Purpose | Data Region |
|---|---|---|
| Vercel Inc. | Edge Ingress, Control Plane Hosting, Lambda Compute | Global / US-East |
| Supabase Inc. | Durable Event Ledger & Control Database (Postgres) | AWS ap-south-1 (Mumbai) |
| Resend Inc. | Transactional Email & Incident Notifications | US |
| Telegram Messenger LLP | Founder Incident Escalation & Approval Routing | Global |
| Razorpay Software Pvt Ltd | Subscription Billing & Payment Processing | India |
Honest Security Non-Claims
• No Unenforced Immutability: We do not call logs "immutable" unless cryptographic tamper-proofing is active.
• PCI Scope: Payment processing is delegated entirely to Razorpay/Stripe PCI-DSS Level 1 infrastructure. Liulum does not handle raw card numbers.
• No Automatic Code Execution: AI models cannot directly deploy unreviewed code to production without passing tests, policy checks, and explicit approval.
• Certifications: Current posture is compliant with DPDP/GDPR principles. Formal SOC2 / ISO27001 audits are scheduled as enterprise volume scales.