Security

What's true today.

Lumen is early software, so this page is short. It lists only what we actually do.

Encrypted in transit: All traffic to Lumen is served over TLS.
Encrypted at rest: Lumen's data is stored on an encrypted disk.
Read-only access to your live PMS: Every request Lumen can make to MEWS is on a short list of reads. A write is refused in code before it is built.
No passwords to steal: You sign in with a six-digit code sent by email. Codes are stored hashed, work once, expire after 10 minutes and allow only a few attempts.
Changes refused on the server: While Lumen runs beside your PMS, the server refuses every attempt to change hotel data, whoever is signed in. Finer per-screen access controls are in development.
Less data held: Identity documents are not copied from your PMS. Lumen doesn't take card payments today, so it doesn't handle card numbers at the desk or online.

What we don't claim

Lumen holds no third-party security certifications today. If your hotel needs one, ask us where things stand before relying on Lumen.

Found a security problem? Email support@symphia.ai and we'll look at it.

If you run on MEWS, we can put a read-only copy of your property in Lumen. Nothing in your hotel changes.