Security at Luna AI

Our approach

Luna AI is used by students, schools, and accessibility organizations. We build with the principle of least privilege: every account only reaches its own study data, and every backend route verifies who is calling before it returns anything.

Data protection

• All traffic is encrypted in transit with TLS; data at rest is encrypted by our cloud provider.
• Study libraries, sessions, and profiles are protected by row-level access rules enforced in the database, not just in the app.
• Raw call audio is not retained after a study session ends.
• Credentials and third-party API keys are stored in an encrypted secret store and are never exposed to the browser.

Access control

• Passwords are hashed by our identity provider; staff never see them.
• Administrative roles are stored separately from user profiles so they cannot be self-assigned.
• Voice-agent backend tools authenticate with a rotating shared secret, so only our configured tutor can request study data.
• Organization administrators only see members of their own organization.

Monitoring and audit logging

Privileged and security-relevant actions are written to an append-only audit log that cannot be edited or deleted, including by administrators. Logs record the actor, the action, the target, and the time, and are retained as evidence for security reviews.

Vendors

We rely on a small set of vetted providers for hosting, database, AI models, voice synthesis, telephony, and email. Each processes data under its own security program and our data processing terms.

Compliance roadmap

We are aligning our controls with SOC 2 Trust Services Criteria (security, availability, and confidentiality) ahead of a formal audit, and designing with future public-sector requirements in mind. This page will be updated as attestations are completed.

Reporting a vulnerability

If you believe you have found a security issue, email security@trylunaai.com with steps to reproduce. Please do not access or modify data that is not yours. We aim to acknowledge reports within three business days and will keep you updated until the issue is resolved. We do not pursue legal action against researchers who act in good faith and follow this policy.