Regulated-industry governance#
The regulated-industry tier is agent governance for teams that need cryptographic evidence, policy-gated execution, operator sign-off, residency controls and reproducible audit bundles.
Live controls#
| Area | Current posture |
|---|---|
| Cryptographic evidence | Evidence receipts are anchored with a Merkle-style chain so historical tampering can be detected |
| Compliance gates | GDPR, HIPAA, and finserv packs can fail closed through the gate-resolver path with auditable decline events |
| Operator sign-off | Mid-execution pause/resume/reject flows compose with dispatch leases and checkpoint events |
| Enterprise auth | SAML sign-in, SCIM provisioning, and MFA (step-up authentication) policy are live and API-configurable — see Enterprise Trust |
Boundaries#
| Area | Boundary |
|---|---|
| Data residency | Key-region, storage-region and evidence-bound routing are enforced; owners pin the workspace region from Dashboard → Trust |
| Audit bundles | Generated bundles are evidence packages, not attestations |
What LumenFlow does not claim#
LumenFlow is not SOC 2 certified, HIPAA certified or otherwise attested. There is no certified integration with a named identity provider, and there is no formal audit attestation. SAML sign-in, SCIM provisioning and MFA policy are live controls.