Security and reliability
Security comes from explicit boundaries and tested behavior. This page describes the local software built in September 2026; it is not a certification or an uptime promise.
Separate products and private workspaces
Every product runs on its own local origin with a separate database, object store and session cookie. Passwords use salted scrypt hashes. Server-side workspace checks isolate saved records and uploaded files. State-changing requests require an authenticated session, a matching origin and a CSRF token.
Shared code conventions do not merge the applications. The local dependency cache is shared to reduce disk usage, while each product carries its own package manifest and lockfile. The earlier merged application and its records remain separate.
A decision belongs to a revision
Server-side version checks reject stale changes. Approval binds the reviewed content digest. Idempotency keys make an identical retry return the original response instead of creating another operation. Product rules add their own constraints: receipt quantities, inventory availability, scheduling windows or configuration limits.
Records and events are stored locally. Exported files include the saved information relevant to their product, such as a specification digest, approved version or exact delivery manifest. A log is useful evidence of the recorded action; it does not prove an external business result.
AI inputs and executable code
AI features use an explicitly configured Google endpoint. The free-tier workflow requires nonpersonal, nonconfidential material and a deliberate request. Generated suggestions remain subject to review and deterministic validation; a model response does not authorize sending messages, charging money or changing external systems.
ReproLab and Launchpad use a pinned local Docker execution image with no network, read-only source, dropped capabilities, limited memory and CPU, and bounded execution time. Imported repositories are restricted to the supported dependency-free Node workflow. These constraints reduce exposure; they are not a promise that arbitrary hostile code is risk-free.
Recovery is part of the workflow
Each product includes a stopped-server backup utility. It captures local database and object-store state with a SHA-256 file manifest. Restore verifies the manifest, stages the copy and preserves the prior state. Credentials are kept out of these data snapshots and must be managed separately.
A ForgeQuote restore was tested into an isolated local state directory: the saved record, private file bytes, authenticated session and idempotent replay survived. This is evidence for that restore scenario, not a tested recovery-time guarantee for every workload.
Current operating boundaries
These releases are local. The marketing website now sends enquiries and applications through Resend when a visitor explicitly submits them. The standalone products remain local; no public deployment, billing integration, managed backup schedule or on-call monitoring has been activated. The applications do not yet include full organisation administration, self-service password recovery or a retention console. Their operating documentation lists current record and file limits.
Before handling public or sensitive customer workloads, agree hosting, identity recovery, retention, monitoring, incident response, provider contracts and independent security testing for that deployment. Keep credentials out of URLs, uploaded source and reports. To report a concrete issue, contact hello@lumiadigital.site with the affected product and reproducible steps, without sending secrets.