How Teurons, Inc. protects your data and your customers' data, and just as importantly, what we have not built yet. Everything below describes controls that exist today. Nothing here is aspirational.
Teurons is a small team. Some controls apply to every product and some apply to one. Each section says which.
Shared sign-in (all products)
Teurons products sign you in through one shared service at accounts.teurons.com, which acts as an OpenID Connect provider for our products on their own subdomains.
- Sign in with email and password, Google or GitHub. Google and GitHub are offered only where they are configured.
- Email and password accounts must verify their email address before they can sign in. Passwords are stored hashed by the authentication library we use (Better Auth), and we never see them.
- Products receive an authorization code and exchange it for tokens. Only the authorization code flow is enabled, and clients cannot register themselves. Teurons administrators register each product.
- Social sign-in links to an existing account by email address only when the provider reports that address as verified and the local account is already verified.
- Rate limiting is enabled on the sign-in service, with counters kept in the database so they hold across requests.
- When someone is removed from an organisation, or an organisation is deleted, products are sent an event so they can end that person's access.
Where Lumio runs
This section and those that follow describe Lumio (lumio.teurons.com) unless they say otherwise.
Everything runs on Cloudflare: Workers for the application, D1 for the database, R2 for uploaded files, Queues for background sync, and Vectorize for the AI Assistant's search index. We operate no servers of our own, so patching and physical security of the underlying platform are Cloudflare's responsibility.
Staging and production are entirely separate environments with separate databases, separate secrets and separate Notion integrations. Production data is never copied into staging or onto a developer machine.
Encryption
Lumio serves all traffic over TLS with HSTS. Notion access and refresh tokens, and any other stored credentials, are encrypted at rest with AES-GCM using a key held outside the database. Encryption fails closed: if the key is unavailable, we refuse to write rather than store anything in plaintext.
API tokens are never stored. We keep a SHA-256 hash and show you the token once, at creation. If you lose it, you rotate it, because we genuinely cannot recover it.
Keeping customers apart
In Lumio, every record belongs to an organisation, and every query is scoped by the caller's active organisation. Reaching another customer's data would require a query that omits that scope, so it is the first thing we check when reviewing any change to a data path.
Content served to the widget is resolved through explicit bindings. A widget can only reach the sources it is bound to, and only the pages those bindings select.
The Lumio widget
The widget runs on your customers' sites, so it gets particular attention.
- Signed identity. Identifying a user requires an HMAC signature generated by your server with your widget's signing secret. An identity cannot be asserted from a browser, so nobody can read another user's read state by editing JavaScript.
- Origin allowlist. Each widget declares which origins may load it, with wildcard subdomains supported. Requests from anywhere else are refused.
- Isolated rendering. The widget renders in an iframe, so its styles and scripts cannot reach into your page, and your page cannot reach into it.
- Content Security Policy, plus X-Frame-Options and nosniff, on Lumio's own surfaces.
Access to our systems
Lumio dashboard accounts use the shared sign-in described above. Sessions are cookie-based, HttpOnly, and expire.
Access to production is limited to those who need it to run the service. Secrets live in the platform's secret store, never in the codebase, and we check for that, because the fastest way to leak a key is to commit it.
How we ship
Changes go through staging before production, with type checking and an automated test suite on every deploy. Database changes are hand-written, reviewed SQL rather than generated migrations.
We run periodic adversarial reviews of the codebase specifically looking for authorisation gaps, cross-tenant leaks and unsafe outbound requests, and we fix what they find before moving on. Dependencies are monitored for known vulnerabilities.
What we don't have yet
Teurons is a small team, and Lumio is in early access. We would rather tell you this plainly than have you discover it during a procurement review.
- No SOC 2 or ISO 27001. No audit is in progress. If you need one to buy, we are not the right fit today.
- No third-party penetration test. Our reviews are internal.
- No uptime SLA. We do not offer one for Lumio during early access, and its terms say so.
- No customer-managed encryption keys, no single sign-on for customers, and no data residency guarantees. Lumio data is processed wherever Cloudflare's network routes it.
- No formally tested disaster recovery plan. We rely on the platform's durability rather than a rehearsed restore.
These are on the roadmap in roughly the order a paying customer asks for them. If one is blocking you, say so. That is useful signal.
Reporting a vulnerability
If you find something in any Teurons product or site, email hello@teurons.com with enough detail to reproduce it. We will acknowledge within 3 business days and keep you updated until it is resolved.
Please give us a reasonable chance to fix it before publishing, and do not access, modify or delete data belonging to anyone else while testing. We will not pursue legal action against researchers who act in good faith within those bounds. We do not run a paid bounty programme, but we will credit you if you would like.
Contact
Security questions, questionnaires and disclosures: hello@teurons.com. For how we handle data, see the Privacy Policy, the Data Processing Agreement and the sub-processor list. Our Terms of Service are also available.