Security and Incident Response

Summary

This summary is a plain-language guide to the main points of this document. It does not form part of the document’s binding terms and does not change their meaning. The numbered clauses govern.

Lucrii hosts Customer Data with Amazon Web Services in Sydney. Hermes’ language models run on Amazon Bedrock in Sydney and Melbourne. Its embedding models run through Amazon Bedrock and may be processed in AWS regions outside Australia.
Data is encrypted in transit and at rest. Passwords are hashed, and sign-in secrets are encrypted.
Lucrii’s servers and database sit in a private network that the internet cannot reach directly.
The database is backed up every day, and backups expire after 7 days. Earlier versions of stored files expire after 30 days.
Lucrii monitors its systems for errors and threats, and scans uploaded files for malware.
Report a vulnerability to support@lucrii.io. Good-faith research under clauses 10 to 12 is authorised, and Lucrii will not take legal action over it.
If an incident affects your Customer Data, Lucrii will tell you without undue delay. Your organisation decides whether to notify the regulator and the people affected, and Lucrii helps.
You keep your own account safe: use a strong password or Google sign-in, turn on two-factor authentication, give people the role they need, and remove people who leave.

1.1 This page is published by Lucrii Pty Ltd (ABN 46 694 710 211, ACN 694 710 211) (Lucrii, we or us). It describes the technical and organisational measures Lucrii uses to protect the Service and Customer Data, how to report a security vulnerability, and how Lucrii responds to a security incident.

1.2 Lucrii’s contractual commitments on security and breach notification are set out in the Terms of Service (Terms) and the Data Processing Addendum (DPA). This page describes Lucrii’s practice and does not form part of the Terms. If this page is inconsistent with the Terms or the DPA, the Terms or the DPA (as applicable) prevail.

1.3 This page adopts the definitions in clause 2.1 of the Terms, including Customer, Customer Data, Owner, Administrator, Service, Hermes, App, MCP Client, Document Page, User, Security Incident and Sub-processor. Capitalised terms not defined on this page have the meaning given in the Terms.

1.4 This page is governed by the law of Victoria, Australia.

2. Where Customer Data is hosted

2.1 Lucrii hosts the Service on Amazon Web Services (AWS) in the Asia Pacific (Sydney) region (ap-southeast-2). The application servers, the database, file storage and outgoing email (Amazon SES) all run in that region.

2.2 Hermes runs on Anthropic Claude models through Amazon Bedrock in Australian AWS regions (Sydney and Melbourne). The embeddings Hermes uses to search records are produced by Cohere Embed models through Amazon Bedrock’s cross-region inference, and those requests may be processed in AWS regions outside Australia. Lucrii does not train AI models, and its AI providers do not train on Customer Data.

2.3 Lucrii delivers the application through Amazon CloudFront, which serves it from AWS edge locations near each User.

2.4 Some of Lucrii’s Sub-processors process limited data outside Australia, as the Sub-processors page describes.

3. Network and infrastructure

3.1 Lucrii’s application servers, database and cache run in a private network with no public IP addresses.

3.2 Lucrii’s load balancer accepts traffic only from Lucrii’s content delivery network, and only over HTTPS.

3.3 The database server accepts connections only from Lucrii’s own services inside the private network, including the service that runs Apps, and from a single administrative access host.

3.4 Lucrii stores infrastructure credentials, signing keys and encryption keys in AWS Secrets Manager.

3.5 Apps from the Lucrii App Store run in a service separate from the main application. An App reaches an Organisation’s data only through the permissions that Organisation approved when it installed the App, or approved for a later version.

4. Encryption

4.1 Lucrii encrypts data in transit:

(a) between Users’ browsers and Lucrii with TLS 1.2 or higher, and does not serve the application over plain HTTP;

(b) between Amazon CloudFront and Lucrii’s servers with TLS 1.2 or higher; and

(c) between Lucrii’s servers and Amazon SES, over a connection that requires TLS (STARTTLS). Amazon SES delivers email to the recipient’s mail server using TLS where that server supports it.

4.2 Lucrii encrypts data at rest:

(a) the database’s storage, and its backups, are encrypted by AWS;

(b) stored files are encrypted with AES-256. Files that Users mark as public, such as pictures for documents, and attachments of emails sent in to the Service are served through Lucrii’s content delivery network and can be opened by anyone who has the file’s unique, randomly generated link. Other stored files are reachable only through Lucrii’s servers or through short-lived signed links;

(d) the secrets behind authenticator-app two-factor authentication are encrypted with AES-256-GCM; and

(e) secrets that Apps store, including the tokens for accounts connected to an App, are encrypted with AES-256-GCM.

5. Access control in Lucrii

5.1 Each User belongs to one or more Organisations with a role: Owner, Administrator, Team Leader or Member. Lucrii checks every request against the User’s membership of the Organisation and the permissions of the User’s role.

5.2 Users can sign in with a password or with Google. Each User can add two-factor authentication with an authenticator app, add passkeys, and save single-use backup codes.

5.3 Lucrii asks a User to confirm their identity again before sensitive changes, once 10 minutes have passed since they last signed in or confirmed. Those changes include turning two-factor authentication on or off, adding or removing a passkey, approving an MCP Client’s connection, installing an App or approving its new permissions, and making someone an Administrator or Owner.

5.4 Lucrii limits the rate of sign-in attempts, and emails a User when it detects a sign-in it considers unusual for their account. Sign-in sessions expire after 30 days, and session cookies are marked secure and HTTP-only.

5.5 MCP Clients connect through OAuth with the User’s approval, and Lucrii limits the rate of each connection’s requests. A User can revoke an MCP Client’s connection at any time.

5.6 Owners and Administrators can read the Organisation’s audit history in Settings, which records changes to settings, members, roles, Plans and Apps. Each record also carries an audit history of changes to it.

6. Staff and administrative access

6.1 Lucrii’s production database cannot be reached from the internet. Administrative access to production systems is limited to personnel who need it, and requires AWS identity credentials.

6.2 AWS CloudTrail records access to stored files.

6.3 Lucrii checks its AWS configuration against rules for encryption, public access and account security.

7. Backups and recovery

7.1 AWS takes an automated backup of Lucrii’s database every day, and Lucrii keeps automated backups for 7 days. Lucrii can restore the database to a point in time within that period.

7.2 When a stored file is replaced or deleted, Lucrii keeps the earlier version for 30 days.

7.3 Backups are stored by AWS in the Sydney region and are encrypted.

7.4 The production database has deletion protection enabled, and a final snapshot is taken if it is ever deleted.

7.5 Copies of deleted Customer Data leave Lucrii’s systems as these backups and earlier file versions expire, as clause 9.3 of the Terms describes.

8. Monitoring and logging

8.1 Lucrii monitors the Service with Amazon CloudWatch alarms for server errors, unhealthy servers, high load and slow responses.

8.2 Amazon GuardDuty monitors Lucrii’s AWS account for threats. It also scans files that Users upload, and attachments of emails sent in to the Service, for malware, and tags any file it finds to be malicious. The scan does not block or remove a file.

8.3 Lucrii records security events for each account, such as sign-ins and changes to sign-in methods, and uses them to detect unusual activity.

8.4 Lucrii keeps its application logs in Amazon CloudWatch for 30 days.

9. Sub-processors and vendors

9.1 Lucrii lists the third parties that process Customer Data on its behalf, with each one’s purpose and location, on the Sub-processors page.

9.2 Lucrii gives notice of a new Sub-processor as clause 7.3 of the DPA provides. The Customer may object to a new Sub-processor, as clause 7.4 of the DPA describes.

9.3 Lucrii’s subscription payments are processed by Stripe. Lucrii does not store payment card numbers.

9.4 Apps, MCP Clients and other services that a Customer chooses to connect, such as Xero and Stripe accounts, are not Lucrii’s Sub-processors. Their own terms apply to the data a Customer sends them.

10. Reporting a vulnerability

10.1 If you believe you have found a security vulnerability in the Service, email support@lucrii.io with “Security” in the subject line.

10.2 Please include a description of the vulnerability, the steps to reproduce it, the affected URL or feature, and any proof of concept. Tell us how to contact you.

10.3 Lucrii will acknowledge your report, keep you informed while it investigates, and tell you when the vulnerability is fixed.

10.4 Lucrii asks that you give it a reasonable time to fix a vulnerability before you disclose it publicly, and that you coordinate the timing of any disclosure with Lucrii.

11. Rules for security research

11.1 When researching a vulnerability in the Service, you must:

(a) test only against accounts and Organisations that you own, or that you have the account Owner’s permission to test;

(b) stop as soon as you have established that a vulnerability exists, and report it;

(c) access, copy or change no more data than the minimum needed to show the vulnerability, and delete any Customer Data you obtain once you have reported it;

(d) not degrade or interrupt the Service, including by denial-of-service testing or high-volume automated scanning;

(e) not use social engineering, phishing or physical attacks against Lucrii, its staff or its customers;

(f) not send email or messages through the Service to people who have not agreed to receive them; and

(g) not test Apps, MCP Clients, or the systems of AWS, Stripe or any other third party, without that party’s permission.

12. Safe harbour

12.1 If you research and report a vulnerability in good faith and in accordance with clauses 10 and 11, Lucrii:

(a) considers your research authorised under its Acceptable Use Policy and the Terms;

(b) will not bring legal action against you, or initiate a complaint to law enforcement, in connection with that research, unless the law requires Lucrii to report it; and

(c) will make clear that you acted in accordance with this page if a third party takes action against you in connection with it.

12.2 Lucrii can authorise research only against its own systems. Clause 12.1 does not bind any third party.

13. How Lucrii responds to an incident

13.1 Lucrii follows the steps in this clause 13 when it becomes aware of a suspected or actual Security Incident, or of a breach of security affecting Personal Information that Lucrii handles for its own purposes under the Privacy Policy (each an incident in this clause 13).

13.2 Lucrii will contain the incident, taking immediate steps to stop further unauthorised access, disclosure or loss, such as revoking credentials, isolating affected systems and preserving evidence.

13.3 Lucrii will assess the incident: what happened, which systems, data and Customers are affected, and the likely harm to the individuals concerned. Where Lucrii suspects an eligible data breach under the Privacy Act 1988 (Cth), it will complete a reasonable and expeditious assessment, and take all reasonable steps to do so within 30 days.

13.4 Lucrii will remediate the cause of the incident and act to reduce harm to affected individuals.

13.5 Once the incident is resolved, Lucrii will review it and apply what it learns to its systems and processes.

14. Notifying customers, regulators and individuals

14.1 Lucrii will notify each affected Customer without undue delay after becoming aware of a Security Incident, by email to the Owners and to any other contact the Customer has given Lucrii for this purpose. The notice will describe, as far as Lucrii then knows:

(a) the nature of the Security Incident;

(b) the kinds of data and the approximate number of individuals concerned;

(d) the steps Lucrii has taken or proposes to take; and

(e) a contact for further information.

Where Lucrii cannot give all of this information at once, it will give it in stages without further undue delay.

14.2 Where a Security Incident may be an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth), Lucrii will assess it with the Customer and take all reasonable steps to complete that assessment within 30 days. The Customer decides whether to notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals, and Lucrii will not notify them about Customer Data without the Customer’s agreement unless the law requires Lucrii to do so. Clause 9 of the DPA sets out how the parties work together.

14.3 For Personal Information that Lucrii handles for its own purposes under the Privacy Policy, Lucrii assesses the breach and notifies the OAIC and affected individuals itself, as the scheme requires. Where Lucrii has reasonable grounds to believe an eligible data breach has occurred, it will, as soon as practicable, give a statement to the OAIC and notify the affected individuals or, where that is not practicable, publish the statement and take reasonable steps to bring it to their attention.

14.4 Where Lucrii is the controller of personal data subject to the EU General Data Protection Regulation or the UK GDPR, Lucrii will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. Lucrii will notify the individuals concerned without undue delay where the breach is likely to result in a high risk to them. Where Lucrii processes personal data for a Customer, it will notify the Customer under clause 14.1 and help the Customer meet its own obligations to notify.

14.5 Lucrii will also notify any other regulator, and cooperate with law enforcement, where the law requires.

15. Customer responsibilities

15.1 Security is shared between Lucrii and its Customers. Each Customer is responsible for the security of its own account and must:

(a) ask each User to sign in with a strong, unique password, or with Google;

(b) encourage its Users to turn on two-factor authentication or add a passkey;

(c) give each User the lowest role that lets them do their job, and limit the Owner and Administrator roles to people who need them;

(d) remove a User from the Organisation on the Members page in Settings promptly when they leave or no longer need access, and revoke any MCP Client connections they no longer use;

(e) review the permissions an App requests before installing it, and uninstall Apps it no longer uses;

(f) keep the devices and email accounts used to access Lucrii secure; and

(g) notify Lucrii at support@lucrii.io without undue delay after becoming aware of any unauthorised access to its account.

16. Changes and contact

16.1 Lucrii updates this page when its security practice changes. Clause 6.2 of the DPA governs changes to the measures Lucrii must maintain.

16.2 Security reports and questions go to support@lucrii.io.

16.3 Lucrii Pty Ltd, ABN 46 694 710 211, ACN 694 710 211, PO Box 784, New Farm QLD 4005, Australia.