Luzmo employs multiple layers of security including encryption at rest and in transit, regular security assessments, and strict access controls to protect your data.

Yes, Luzmo is fully GDPR compliant. We act as a data (sub)processor for our customers and have implemented all necessary measures to comply with GDPR requirements.

If you wish to process Personally Identifiable Information (PII) on the Luzmo platform, you can sign a Data Processing Agreement (DPA) with us in Luzmo's Legal & Compliance section.

Whether we store your data depends on the data connector types you're using and your settings.

By default, Luzmo does not store your data, but only processes it in-memory after which it is promptly discarded.

If you enable query result caching on a connection or dataset, we temporarily cache your data in an in-memory store up to your configured Time-To-Live (TTL).

If you use any of the following data connector types or features, we persistently store your data in a secure, multi-dimensional analytical data store, until you delete the dataset or the license comes to an end.

• Google Analytics
• Google Drive
• Luzmo API Push
• Luzmo Warp

Luzmo operates 2 multi-tenant clouds: in the European Union 🇪🇺 (AWS, eu-west-1 (Ireland) region) and in the United States 🇺🇸 (AWS, us-east-2 (Ohio) region). You can choose your data tenancy during sign-up. Your data is strictly processed and/or stored only in your selected regions.

Luzmo offers dedicated cloud deployments in any public AWS, Azure or Google Cloud Platform region globally. Customers can also opt for a EU sovereign cloud deployment on Scaleway or OVHCloud.

Luzmo offers a Helm Chart self-hosted edition. Specific pricing applies.

Luzmo connects to a variety of data sources natively, incl. relational databases (PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, etc.), data warehouses (ClickHouse, Snowflake, BigQuery, Redshift, Athena, Synapse, etc.), file systems (Google Drive), Google Analytics, and more.

Luzmo uses TLS1.2+ encrypted connections. You can use IP whitelisting to allow our dedicated IP addresses to connect. We also offer AWS Private VPC endpoints on our Multi-tenant Cloud and AWS Private VPC Endpoints or AWS, Azure or Google Cloud VPC Peering on dedicated cloud deployments.

It's also possible to create your own data connectors using our Plugin API.

Luzmo's AI features, including chart/dashboard agents and Luzmo IQ, are not trained on customer datasets. Luzmo logs conversations for the duration of our regular log retention window to help in issue investigations or to identify areas where the service accuracy needs to be improved.

Luzmo uses OpenAI's API for AI features, with data residency matching the Luzmo multitenant cloud or dedicated cloud residency. OpenAI does not use prompts or responses to train models. Luzmo has a zero data retention agreement with OpenAI: OpenAI does not store any data from Luzmo's usage of their API.

What the model receives depends on the feature. Lookups and queries run in Luzmo's query engine, under the viewer's access control, outside the model.

Metadata only: column and dataset descriptions, metadata suggestions, and formula generation. The model sees names, types and descriptions. No cell values and no query results.

Category values: chart generation and dashboard creation. The model receives a sample of distinct values from category columns, and further lookups when a filter needs an exact value. Those values can include personal data. It does not receive measure results or the chart's query output.

Query results: AI summaries, Luzmo IQ, and Luzmo IQ agentic APIs and MCP. The model receives the query result, which may include personal data. Results are aggregated unless the chart or question is a row listing. Category values may also be looked up, or embedded, to match a filter or a classification.

Yes, Luzmo is compliant with HIPAA (Health...) regulations. If you wish to process healthcare records that fall under HIPAA regulations, you can request a BAA.