# Trust and security: data, AI and sub-processors > How Lumtry secures merchant data, keeps AI inside a deterministic refund policy, lists every sub-processor and explains data flow and retention. Review it. - Canonical URL: https://lumtry.com/trust - Last updated: 2026-09-24 This page explains how Lumtry protects your data, where AI fits into a refund decision, which sub-processors we use, and how information flows through the Service. ## Security Every workspace runs on the same security posture. Here is what protects your data today. - **Tenant isolation**: Each organization's data is separated by row-level security, and the backend re-checks access on every request. One workspace cannot read another workspace's records. - **Append-only audit trail**: Every decision, signal, and override is written to an audit trail that cannot be edited or deleted. Each entry carries a correlation ID, so a case can be traced from start to finish. - **No raw card data**: Lumtry never stores card numbers. Refunds and charges reference a processor token instead, so card data stays with the payment processor. - **Encrypted in transit**: Traffic to Lumtry is encrypted in transit, and the dashboard sends strict security headers, including a content security policy and HSTS. - **Verified webhooks**: Every incoming webhook, whether from your store, your payment processor, or Slack, is signature-verified before Lumtry writes anything to your data. A webhook with an invalid signature is rejected. ## How Lumtry uses AI - A deterministic policy that your organization writes and versions decides each case. A refund already in progress stays pinned to the policy version it started under. - AI reasoning is one input to that policy, never the decision itself. It scores ambiguous cases and writes a rationale, scoped to what the policy already allows. - A person approves any case the policy does not clear on its own, from the dashboard or from Slack, before anything executes. - Shopper-facing text that AI helps draft is marked as AI-generated by construction, unless a person edits it and sends it under their own name, so you can tell which words came from a person and which came from the model. - Shoppers can request a human review of their case from the return status page. - Lumtry does not publish an accuracy or performance figure for AI-assisted decisions, because the policy, not the model, decides. ## Sub-processors Lumtry works with the providers below to run parts of the Service. Each entry shows its role, status, and what we can verify today. Where this is documented These policies and pages reference the same sub-processors. Document What it covers ## How data flows This section explains what leaves Lumtry's systems, where it goes, and what stays inside. How a request leaves Lumtry Identifiers we pseudonymize What never leaves Lumtry Route classes Telemetry ## Data retention Retention periods vary by provider and data type. Each sub-processor section above lists that provider's retention row; here is what those settings mean. See the retention row in each provider's sub-processors section above for that provider's specific period. ## Contact us Questions about this page, your data, or how Lumtry uses AI? Reach either team below. ## Related - [Home](https://lumtry.com/index.md): Decide refunds by a versioned policy, send the exceptions to your team in Slack or the dashboard, and keep every step on the record. Start free. - [Features](https://lumtry.com/features.md): Versioned refund policy, AI reasoning only where rules leave room, Slack and dashboard approvals, Stripe and PayPal execution and a full audit trail. See it all. - [Pricing](https://lumtry.com/pricing.md): Lumtry plans by case volume and seats, from Free to Enterprise, with add-ons and capped outcome fees. Start free or hear when billing opens. - [About](https://lumtry.com/about.md): Why Lumtry exists: refunds should be decided by a policy you can defend, reasoning you can inspect and approvals your team controls. Read the story. - [Privacy](https://lumtry.com/privacy.md): How Lumtry collects, uses, shares and protects personal information, isolates tenant data, records AI rationale and lists sub-processors. Read the policy. - [Terms](https://lumtry.com/terms.md): The binding terms for using Lumtry: policy plus AI reasoning with a human approval gate, plans and billing, and the limits of liability. Read them in full. - [Solutions](https://lumtry.com/solutions.md): Four ways Lumtry puts policy, approvals and an audit trail around the money you give back: refunds, returns and labels, chargebacks, retention and abuse. - [Demo](https://lumtry.com/demo.md): Run a sample refund through intake, AI signals, policy, approval and audit in your browser. Change a rule, rerun the case and share the link. Try it now. - [Integrations](https://lumtry.com/connectors.md): Connect Lumtry to Shopify, WooCommerce, BigCommerce, Amazon, eBay, Stripe, PayPal, Slack, Gorgias, Zendesk, EasyPost and Shippo. Browse every integration. - [Contact](https://lumtry.com/contact.md): Questions about Lumtry, launch pricing, integrations or security? Send a message and the team replies by email. Tell us about your refund volume. - [Get started](https://lumtry.com/get-started.md): Pick the refund problem to fix first, choose a plan and create your Lumtry account. Start on the Free plan and connect your store when you are ready. - [Developers](https://lumtry.com/developers.md): Send signed refund webhooks to your tools, call the REST API and let your AI assistant work with Lumtry cases over MCP. Explore the developer tools. - [Refund cost calculator](https://lumtry.com/calculator.md): Estimate a year of manual refund handling and return abuse leakage from your own numbers, then see which Lumtry plan fits your volume. Run the numbers. - [Roadmap](https://lumtry.com/roadmap.md): What Lumtry has shipped, what is coming next and what is further out across refunds, returns, disputes and integrations. Get notified when items ship. - [Compare](https://lumtry.com/compare.md): Lumtry side by side with the tools SMB merchants use for refunds today, built from each vendor's own public pages. Find the right fit for your store. - [Guides](https://lumtry.com/guides.md): Answer-first guides to refunds, returns, chargebacks, approvals and audit trails for Shopify, WooCommerce and BigCommerce merchants. - [Glossary](https://lumtry.com/glossary.md): Plain definitions of refund, return, chargeback, RMA, store credit, audit trail, idempotency key, MCP and other refund operations terms. - [MCP server](https://lumtry.com/developers/mcp.md): Connect an AI assistant or your own agent to your refund workspace through the Model Context Protocol. Read cases and propose actions, never move money. - [llms.txt](https://lumtry.com/llms.txt)