SECURITY

Last updated August 27, 2026

This page explains how LuBot (operated by Lubo Bali) protects data on the LuBot Services (https://lubot.ai) and through the LuBot MCP server (https://mcp.lubot.ai). It is written in plain English so both users and third-party reviewers (Anthropic Connectors Directory, Official MCP Registry, OpenAI Apps SDK) can verify our posture.

DATA HANDLING SUMMARY

What LuBot processes: your uploaded files (Excel, PDF, CSV, images), portfolio holdings you connect via read-only brokerage links, website traffic data you connect via read-only tokens, and the questions you ask about them. LuBot does not process data you did not explicitly connect or upload.

What LuBot stores: connected data is stored in per-tenant Neon Postgres branches (one isolated database per paying customer, one shared anonymous pool for demo users). Uploaded files are stored in Amazon S3 (US region), retained until you delete them. Chat history is retained so the assistant remembers earlier questions in the same account. Session-level analytics events (page views, clicks, session ID) are stored in a shared events table and used to understand product usage; they never contain your uploaded file contents.

ENCRYPTION

In transit. All connections to and from LuBot use TLS 1.2 or newer. HTTP is redirected to HTTPS at the edge. MCP tool calls are authenticated with OAuth 2.1 bearer tokens over HTTPS. Certificates are managed by Let's Encrypt and auto-renewed.

At rest. Neon Postgres branches (including all per-tenant databases) are encrypted at rest with AES-256 by the Neon platform. Amazon S3 buckets are encrypted at rest with SSE-S3. Clerk-managed authentication data (session tokens, user identifiers) is encrypted at rest by Clerk. Secrets (API keys, database URLs, OAuth signing keys) are stored in environment variables on the LuBot host and are never checked into source control.

TENANT ISOLATION

Every LuBot user has isolated access to their own data. Paying customers get a dedicated Neon Postgres branch, resolved at request time through a single database-access seam (tenant_resolver.get_tenant_engine(user_id)). Anonymous demo users share a pooled tenant with clearly labelled sample data. Cross-tenant reads are prevented at three layers: the resolver seam, per-connection Postgres search_path scoping, and regression tests that assert one user cannot see another user's rows. The MCP server enforces the same isolation: every tool call resolves the caller's identity from the OAuth token before touching any data.

AUTHENTICATION AND ACCESS

Web application. User authentication is managed by Clerk with support for email + password, Google, GitHub, and other social providers. Passwords are never stored or seen by LuBot.

MCP server. Third-party AI clients (Claude Desktop, Cursor, VS Code, and other MCP-compatible tools) connect through OAuth 2.1 with PKCE (S256 only), dynamic client registration (RFC 7591), refresh-token rotation, and resource-indicator binding (RFC 8707). Protected-resource metadata is published at /.well-known/oauth-protected-resource. A full compliance breakdown is available in the LuBot OAuth Compliance Audit at services-agent-api/docs/market-engine/oauth-compliance-audit.md.

Personal access tokens (PATs). Available for scripting and CI. Every PAT is scoped to a single user, revocable, and audit-logged on each tool call.

AUDIT LOGGING

Every MCP tool call is written to an append-only audit log with the tool name, calling client (Claude Desktop, Cursor, etc.), a hashed tenant identifier (SHA-256 of the user id, never the raw id), a hash of the arguments, execution latency, and success/error category. Uploaded file contents and portfolio holdings are never written to the audit log.

THIRD-PARTY SUBPROCESSORS

LuBot processes data through the following subprocessors. Categories, not user-specific access.
  • Neon — per-tenant Postgres database hosting (US regions).
  • Amazon Web Services (S3, KMS) — uploaded file storage and key management (US regions).
  • Clerk — user authentication, session management.
  • Supabase — admin metadata (customer signup requests, per-organization mapping).
  • Anthropic, NVIDIA, and OpenRouter — LLM inference for LuBot chat responses. Your questions and the retrieved context are sent to the model provider to generate answers. Providers process the content solely to serve the response and do not use it for model training under our terms.
  • Hetzner — application server hosting (Germany).
  • Stripe — subscription billing. Credit card details are handled entirely by Stripe; LuBot never sees your card number.
  • Plaid — read-only brokerage connections (for the Stock module only). LuBot never receives login credentials — Plaid supplies a scoped read-only token.

DELETION AND EXPORT

Self-serve. Signed-in users can delete any uploaded file from the My Files page. Deleting a file removes it from the associated per-tenant Postgres database and marks the corresponding S3 object for deletion within 24 hours.

Full-account deletion or data export. Email support@lubot.ai with the subject line "Delete my account" or "Export my data." We will delete or export your entire account within 30 days and confirm by email.

VULNERABILITY DISCLOSURE

If you discover a security issue in LuBot or the LuBot MCP server, please email support@lubot.ai with the subject line "Security report." We commit to acknowledging your report within 3 business days and to keeping you updated as we investigate. We do not currently offer a paid bug bounty; we do publicly credit reporters who ask to be named.

Please do NOT test the LuBot production system with automated scanners or attempt to access data you do not own. Coordinated disclosure only.

COMPLIANCE POSTURE

Honest current state (as of August 2026): LuBot is a solo-operated SaaS product. LuBot does not currently hold SOC 2 Type II, ISO 27001, or HIPAA attestations. LuBot follows the security engineering practices described on this page (encryption in transit and at rest, per-tenant database isolation, OAuth 2.1 with PKCE for MCP, audit logging on every tool call, no cross-tenant reads verified by regression tests, secrets never in source control). If your use case requires a specific compliance attestation, please email support@lubot.ai — we can discuss timeline and scope.

INCIDENT RESPONSE

In the event of a security incident that affects your data, LuBot will notify affected users by email within 72 hours of confirming the incident, with a description of what happened, what data was involved, what steps we have taken, and what steps you should take. The notice will be signed by Lubo Bali and will include a direct contact for follow-up questions.

CONTACT

Questions, concerns, or reports: support@lubot.ai