Trust Center
Everything you need to check that LuminaOS meets your data protection requirements before you sign. Transparent by design.
Legal documents
The Privacy Policy and Cookie Policy cover the luminaos.cloud website. The Data Processing Agreement and Terms and Conditions are provided with your proposal.
Our Art. 28 GDPR DPA: how we process personal data on your behalf, including sub-processors, breach notification, encryption key management and deletion.
How Agile Futurist handles personal data processed through LuminaOS and this website.
Which cookies this website uses, and how to manage your consent.
Sub-processor register
In line with Art. 28(3)(d) GDPR, we maintain a public register of sub-processors, with at least 30 days’ advance notice of changes.
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services (AWS): cloud infrastructure and storage | Compute, object storage (Amazon S3), networking and databases underpinning the platform. | EU (Ireland, eu-west-1) | N/A (EEA) |
| Amazon Web Services (SES): email delivery | Transactional and notification emails. | EU (Ireland, eu-west-1) | N/A (EEA) |
| Mistral AI SAS: AI language model (default) | Language model for the website assistant on luminaos.cloud and the platform’s HR assistant. Requests are sent to Mistral’s endpoint in the EU. | EU (Paris, France) | N/A (EEA) |
| Amazon Web Services (CloudWatch): monitoring | Application performance monitoring, logging and alerting. | EU (Ireland, eu-west-1) | N/A (EEA) |
Last updated: October 2026. To receive sub-processor change notifications, email dpo@agilefuturist.com with the subject “Sub-processor notifications”.
Security measures
A summary of our security measures. The full schedule is part of the DPA.
Encryption key management
Every environment is encrypted at rest with AWS KMS, under keys created for your tenancy alone. You choose who holds the material of your data keys.
Default
We manage the encryption keys on your behalf in AWS KMS, with annual key rotation. This is the default on all plans and requires nothing from you.
On request
You generate the key material on your own computer and keep your own copy. At any point you can withdraw the key service’s copy, which makes every stored copy of your data unreadable to every party at once, us and AWS included.
Live
Every backup and long-term archive is also written as an export copy encrypted to a key only you hold, so you can open it on your own computer without us.
What this does not change: our infrastructure runs on AWS, a US-headquartered provider, in EU regions, so we do not claim your data is beyond the reach of legal process. For questions about the US CLOUD Act, contact our Data Protection Officer at dpo@agilefuturist.com.
Compliance
We are transparent about where we are on the path to independent verification.
Live
DPA available, sub-processor register maintained, DPO designated. All processing on documented controller instructions only.
Live
Customer data is stored and processed in the EU (Ireland, AWS eu-west-1).
In preparation
Preparation with an external partner starts in November 2026; certification is targeted for Q2 2027.
Data protection
For questions about data protection, GDPR, the DPA, or to exercise data subject rights.
Next step
Book a free 30-minute demo, built around your property.
