Trust center
How we protect your data and your pricing decisions.
A plain account of the security controls in place today — written for the person running your vendor review.
Data protection
Encrypted in transit and at rest, isolated per workspace, hosted in the EU.
Access control
Two-factor authentication and invitation-only workspaces.
Decision governance
Approvals, guardrails and a history of every price change.
Compliance documents
DPA, sub-processor list, privacy policy and terms.
Controls in detail
Data protection
- Encryption in transit
- All traffic is served over TLS 1.2 or later.
- Encryption at rest
- Database and file storage are encrypted at rest (AES-256) by our infrastructure provider.
- Workspace isolation
- Row-level security policies restrict every query to the signed-in user's workspace.
- Data residency
- Customer data is stored in the EU (Frankfurt, Germany).
Access control
- Two-factor authentication
- Authenticator-app MFA for every account, required again for sensitive actions.
- Workspace invitations
- Owners invite teammates to their workspace and choose who approves price changes.
Decision governance
- Nothing changes on its own
- Recommendations are applied only when someone approves them. Autopilot is opt-in.
- Approval thresholds
- Changes above a percentage you set are queued for a named approver before they go live.
- Hard guardrails
- Margin floor, MAP and maximum change per step are enforced by the pricing engine — including under autopilot.
- Change history
- Applied price changes are recorded with their inputs, reasoning and who made them, and can be exported.
Your data
- GDPR and data processing agreement
- Our DPA and full sub-processor list are published.
- Export and deletion
- Export your data or delete your account yourself, from settings.
How AI is used
The model explains. Your rules and your people decide.
Prices are calculated, not generated
The recommended price comes from a deterministic pricing engine using your data and your guardrails. Language models write the plain-English explanation; they never set the number.
Model providers and your data
Language-model requests go through an AI gateway under terms that do not allow customer data to be used for training upstream models. It is listed on our sub-processor page.
Security questionnaire or review?
Send us your questionnaire and we will answer it directly. To report a vulnerability, email security@luska.ai. If a security incident affects your data, we will notify you without undue delay.