Trust & Security

AuditWorks runs on Lovable Cloud, which combines a managed Postgres database (Supabase) with a globally distributed edge runtime (Cloudflare Workers). All traffic between your browser and AuditWorks is served over HTTPS/TLS, and the database is operated in a managed environment with isolated network access.

Each audit firm's data is logically isolated by a tenant identifier (firm_id) enforced at the database row-level so users from one firm cannot read another firm's records.

• Accounts are created by firm invitation only — open self-signup is disabled.
• Passwords are checked against the Have I Been Pwned database during signup and password changes; known-breached passwords are rejected.
• Role-based access (Junior, Senior, Supervisor, Manager, Director, Partner, Audit Admin) controls what each user can see and change.
• Workspace assignments restrict engagement-level access — staff only see audits they are assigned to.
• Privilege changes (role, firm, super-admin) are blocked at the database level unless performed by an authorized admin.
• Client portal sessions use signed, short-lived tokens distinct from staff credentials.

• In transit: TLS 1.2+ on every request between client, application, and database.
• At rest: the underlying database storage and object storage are encrypted at rest by the cloud platform.
• Secrets: API keys, service tokens, and signing secrets are stored in an encrypted secrets store and never exposed to browser code.

Uploaded workpaper attachments and client files are stored in private object storage buckets. Files are served only through short-lived signed URLs after the server has verified the requesting user's firm, role, and workspace assignment. Public listing of buckets is disabled.

File paths are scoped by firm and workspace, and an explicit path check rejects any request that does not match the requester's firm and assignments.

Every uploaded file is scanned server-side: executable extensions and binaries (Windows, Linux, macOS, shell scripts) are blocked by magic-byte inspection, size limits are enforced, and the file hash is checked against the VirusTotal antivirus aggregator. Anything flagged as malicious is removed from storage before it can be accessed and the scan result is logged for the firm's audit admin.

Audit data is retained for as long as the engagement is active and for the period required by the firm's professional standards. Pending invitations, temporary client credentials, and password-reset tokens expire automatically. On written request, a firm can have its data exported and purged.

AuditWorks uses only the cookies and local storage required to keep you signed in and to remember UI preferences. No third-party advertising or tracking cookies are set.

The following providers process data on AuditWorks' behalf:

• Lovable Cloud — application hosting, database, authentication, file storage.
• Cloudflare — edge network, TLS termination, DDoS protection.
• Email delivery provider — transactional emails (invitations, notifications, password reset).

Contact us if you need the current contractual subprocessor list for a vendor review.

If you believe you have found a security vulnerability in AuditWorks, please report it privately so we can fix it before disclosure. Do not test against live client data.

security@mylumera.net

In the event of a confirmed security incident affecting customer data, AuditWorks will notify affected firm administrators by email without undue delay, describe the nature and scope of the incident, the data involved, and the steps taken to contain and remediate.

AuditWorks is not currently certified under SOC 2, ISO 27001, HIPAA, or PCI DSS. We follow industry baseline practices — least-privilege access, encryption in transit and at rest, audit logging, invitation-only accounts, and breached-password screening — and can share a security questionnaire on request.