Security

Your money stays where it is

Lumen can look but never touch. Here's how bank connections, encryption and your data work, in plain English.

The short version

Encryption

Everything you send to Lumen travels over TLS 1.3, the same protection your bank uses for online banking.
Stored data is encrypted with 256-bit AES. Encryption keys are kept in a separate key-management service and rotated regularly.
Read-only access

Lumen can see balances and transactions. It cannot move money, make payments or change anything in your bank account.
You give permission through your own bank’s app or website. Lumen never sees or stores your banking password.
Our open banking partner

Bank connections run through an open banking partner authorised by the Financial Conduct Authority as an account information service provider.
You confirm access every 90 days, and you can withdraw it at any time from Lumen or from your bank.
Where your data lives

Your data is stored in UK data centres. It is not sold, and it is never shared with advertisers.
Only a small number of staff can access production systems, and every access is logged and reviewed.
Deleting your data

Delete your account in Settings and your bank connections are cut immediately.
Your data is erased from live systems within 30 days and drops out of encrypted backups within a further 35 days.
Protecting your account

The app locks with Face ID, fingerprint or a passcode. New devices need a one-time code before they can sign in.
Found a security issue? Email security@lumen.example and we will reply within two working days.

Questions about security? Read our privacy notice, or get the app and look for Help → Security.