Security isn’t an add-on.
Lumè was designed with security and compliance at the foundation. Every spa, on every plan, runs on the same protected architecture.
On every plan
The same protected architecture.
- HIPAABuilt in, not a tier
- BAAWith every customer
- Tenant isolationYour data, separate
- Audit loggingEvery record opened
- AWSUnder a signed BAA
Your data is isolated.
Every spa’s clients, charts and payments are walled off from every other spa’s: each record carries its spa’s key and every query is filtered by it. Nobody at another business can reach your records, and there is no “secure plan” to pay for because there is only one architecture.
Every important action is traceable.
When someone opens a client record, signs a form, closes an invoice or exports a report, Lumè writes it down: who, what, when and from where. The log can’t be edited or deleted, and when an audit or a question comes up, we pull the record for you.
Append-only. Entries can’t be edited or deleted, by anyone.
Access is controlled.
Each person sees what their job needs. Your front desk can book and check out without reading clinical notes; your bookkeeper sees payments, not charts. You can adjust any individual, and every change is logged.
- OwnerEverything, including billing and permissions
- ManagerRuns the spa day to day
- Front deskScheduling, check-in and checkout
- ProviderTheir schedule and clinical charts
- BookkeeperPayments and financial reports
- MarketingCampaigns and audiences
Infrastructure built for sensitive data.
Amazon Web Services, under a signed BAA
Compute, database and email all run on AWS services covered by the agreement.
Encrypted at rest and in transit
Your database and its backups are encrypted, and credentials rotate automatically.
A BAA with you, on every plan
Lumè signs a Business Associate Agreement with every customer.
The technical detail, on the record.
Each item cites the architecture decision record it was written down in.
Tenant architectureADR 0001
Every model that holds client data carries a tenant key at the database schema level, and queries go through a tenant-scoped manager.
The tenant is resolved from the request, never from client input, so there is no API path that reads across tenants.
PermissionsADR 0003
A 36-permission catalog resolved on every request, with six default roles: owner, manager, front desk, provider, bookkeeper and marketing.
Per-user overrides are explicit and audit-logged. Locked permissions can only come from a role, never an ad-hoc grant, to keep separation of duties.
Audit loggingADR 0004
Every read of protected health information, every state change, every report run and every CSV export writes an audit entry with the user, IP address and user agent.
In production a Postgres trigger rejects UPDATE and DELETE on the audit table, making it append-only. This supports HIPAA §164.312(b) and maps to SOC 2 CC 6.1.
Lumè queries the log by date, user or record and provides it for your audits and investigations on request.
PHI containmentADR 0013
Audit entries record what happened, never the PHI itself. Email addresses are reduced to their domain in the audit trail.
Reports that list individual clients require an explicit confirmation before CSV export, and the confirmation is logged. Email containing PHI, such as a copy of a signed consent, is sent only when a staff member initiates it.
Public links and sessionsADR 0011
Client-facing links such as form fills use 256-bit tokens in the URL path, never the query string, and are single-use for state-changing actions.
The staff application uses session-cookie authentication with CSRF protection.
Encryption and infrastructureADR 0012
Production runs on AWS services covered by a signed Business Associate Agreement: Fargate compute, RDS Postgres encrypted at rest with KMS, and SES for email with DKIM, SPF and DMARC.
Backups are encrypted and database credentials rotate automatically.
AI SMS agentADR 0032
The agent runs on Claude through Amazon Bedrock, inside AWS’s BAA. It sees an allow-listed slice of client context and never chart notes, treatment records, intake answers, medical history or payment details.
Tool-call logs are scrubbed before storage, and every outgoing message is scanned for sensitive data before it is sent. It is off until a spa turns it on.
Data export
CSV export is available on every report, on every plan, at no charge. Your data is yours to take with you.
Compliance documentation
For architecture diagrams, control mappings or a vendor security questionnaire, email info@getlumecrm.com and we respond directly.
See Lumè in action.
Get a personalized walkthrough using your real services, staff, and workflows. Plans start at $149 a month.
One business day to a calendar invite.