This page describes LuxGov's real, current security, governance, and enterprise-readiness posture — what's built, what's tested, and what's still in progress. We update it as our posture changes, and we say so plainly when something isn't finished yet. If you need more detail than this page provides for a security review or procurement process, contact us directly.
Last verified: 14 August 2026
This page exists for enterprise buyers, IT reviewers, security reviewers, procurement teams, and auditors who need a direct, honest answer to "what does LuxGov actually have in place today." It is not a sales page. Every claim below reflects our real, current posture, and every section is dated so you can tell how fresh it is.
Last verified: 14 August 2026
LuxGov's technical controls include tenant isolation enforced at the database level, role-based access control, sovereign storage architecture, audit logging, and MCP boundary enforcement — each described in its own section below. These are real, verifiable controls already in the product, not aspirational statements.
Last verified: 14 August 2026
Customer data is isolated at the database level using PostgreSQL Row-Level Security (RLS) — not application logic alone. Our application's runtime database role cannot bypass this isolation; only a separate, restricted administrative role used for migrations and support can. Row-Level Security is enforced on every project, evidence, and governance-state table.
A small, explicitly documented exception exists for account login and billing lookup tables, which by nature require cross-tenant matching at sign-in. This is a deliberate, reviewed design decision, not an oversight.
Last verified: 14 August 2026
Access within a tenant is governed by role-based access control, enforced on the server side — not only in the interface. Role and permission checks are actively maintained, and when gaps are identified, they are fixed and independently re-verified in the live environment before being considered closed.
Last verified: 14 August 2026
LuxGov stores evidence in jurisdiction-specific storage infrastructure. As of August 2026, per-jurisdiction routing configuration is live for all five supported jurisdictions — Australia, Malaysia, Singapore, United Kingdom, and United States.
Full end-to-end verification of correct jurisdiction routing has been independently completed for Australia. The same configuration is confirmed live for the other four jurisdictions; end-to-end verification for those is in progress and will be reflected here once complete.
Last verified: 14 August 2026
Evidence retention is jurisdiction-aware. Australia and the United States use hard-locked, time-based immutable retention — evidence cannot be deleted early by anyone, including LuxGov administrators, for the duration of the retention period. Other supported jurisdictions currently use a softer retention posture.
All storage infrastructure runs on single-datacenter infrastructure today. Geo-redundancy is not yet in place for any jurisdiction — an open item we are not claiming otherwise on.
Last verified: 14 August 2026
LuxGov's MCP (read-only intelligence access) lets your own AI tools ask questions about your projects, evidence, and status — using your own AI subscription, at your own cost. Every response is read-only, tenant-isolated, and carries a boundary statement making clear it is not a compliance verdict, certification, legal opinion, or approval of any kind.
It surfaces evidence. A licensed reviewer or certifier makes the compliance determination — always. This pattern has been validated internally, at a technical level, across independent AI platforms. A broader pilot with sustained real subscriber usage is planned and has not yet completed — we do not describe this as a finished customer pilot.
Subscribers who want to connect their own AI assistant (Bring Your Own AI) can find full setup guides, supported/unsupported platforms, and honest security guidance in the BYOA Documentation.
Last verified: 14 August 2026
LuxGov has live monitoring and alerting running on production infrastructure, tested end-to-end this month with a real, confirmed notification delivery test. This does not yet cover every alert type we have planned, and does not yet represent a long, sustained operating track record — both are actively being built out.
We do not describe this as comprehensive coverage or as 24/7 monitoring by a staffed security team. It is automated alerting, tested and working, with room still to grow.
Last verified: 14 August 2026
LuxGov has a documented, tested incident-response process. It has been tested against a real production incident and, separately, a deliberately different simulated scenario — with corrective improvements applied and recorded after each.
We do not yet have a customer-facing incident status page or a defined incident-notification SLA. This is a known gap we are working toward, not something we currently offer.
Last verified: 14 August 2026
Our Privacy Policy and Terms of Service are published today, in draft form, referencing applicable regional data-protection frameworks. Both are being finalized, and we'll update this page and the documents themselves as that work completes.
Data Processing Agreement is in preparation and available on request pending legal review.
Last verified: 14 August 2026
LuxGov has not yet completed certification or independent audit against any formal international standard, including ISO 27001, SOC 2, or GDPR. We are actively preparing for international standards readiness.
Real technical controls already in place today — tenant isolation, role-based access control, sovereign storage, audit logging, and evidence-only AI boundaries — would credibly support several of these standards' technical domains once the remaining organizational and legal preparation is complete. We can share current control evidence directly with your security or procurement team on request.
Last verified: 14 August 2026
In the interest of being direct, here is what we do not currently claim:
If any of this changes, we will update this page.
Request Security Documentation
For a security questionnaire, deeper technical detail, or a conversation with your procurement or security team, contact us directly.
Email: admin@luxgov.net