Security at Lutril
What Lutril collects, field by field. How long it is kept, how it is encrypted, who else processes it, and what happens during an incident.
France, on OVHcloud, which is ISO 27001 and SOC 2 Type II certified.
No. No workspace data is transferred, replicated or backed up outside the European Union.
None. Lutril uses no language model provider and no third-party classification service.
An independent third party every quarter, plus automated dynamic scanning every week against the live application.
Topics
The categories of data that never reach Lutril at all.
Lutril stores identity and entitlement metadata, not the content of your work.
Durations are sized to your audit cycle. Governance evidence is kept for the contract term; operational logs are bounded.
How tokens, keys and passwords are encrypted, and what bounds their use.
Three subprocessors. The current list is maintained on the subprocessors page.
Each workspace is isolated by the database itself, not by application code.
Two optional modules read content rather than metadata.
Automated static and dynamic analysis on a continuous cycle, independent penetration testing every quarter.
As controller you have 72 hours to notify your supervisory authority. Lutril commits to 48.
Least privilege, mandatory multi-factor authentication, logged administrative access.
Frameworks we run against, export of your data at any time, and the documents available under NDA.
Common questions
Do you sign a data processing agreement?
Yes, and we sign it before any real data enters the platform. It covers every requirement of article 28 of the GDPR, including subprocessor notification with a right to object, assistance with data subject requests, and deletion or return at the end of the contract.
Can we see your penetration test report?
Yes, under NDA. Write to security@lutril.com and we send the latest blackbox report, the whitebox code review and the full data processing agreement. We can sign a mutual NDA the same week.
Do you use AI to process our data?
No. Lutril has no language model provider as a subprocessor, no workspace data is sent to one, and the sensitive-data detectors are deterministic rules running on our own servers in France. If that ever changes you are notified in advance, with a right to object.
Can we run a proof of concept without real data?
Yes. A proof of concept works on a reduced scope: one read-only directory integration, a subset of organizational units, and no write action until you decide otherwise. Several customers start that way before signing the data processing agreement.
How quickly would you tell us about a breach?
Within 48 hours of qualifying a confirmed incident affecting your data, by email to the security contact you designate, plus a phone call if it is critical. Your own regulator allows you 72 hours.
What happens to our data when we leave?
You choose export or deletion. Deletion in the application completes within 30 days of your request, and no backup is ever restored into production without re-applying the deletions requested since it was taken.
Our latest blackbox penetration test report, our whitebox code review and our full data processing agreement are available under NDA. We can sign a mutual NDA the same week.
Contact security@lutril.com