Security at PRELUDA

Your identity stays with us

We use AI from Anthropic to gather evidence about the app.

The AI receives the app's name and address. It also receives your answers about the use.

Name, email and organisation are never sent there.

Free text is cleaned by rules in our own code before anything is sent.

The link between you and the review exists only in our database.

A person approves every report

Nothing reaches you before someone at LUMRA has read and approved the report.

Advice to wait or advise against requires two people.

Every quote in the report is checked against the page we fetched ourselves.

Hosted in Sweden

PRELUDA runs with a Swedish hosting provider. The database is in Sweden.

The database is encrypted on disk with LUKS2 and AES-256.

All traffic is encrypted with TLS 1.2 or 1.3. Older protocols are switched off.

Your link to the report

You need no account. The report opens with a personal link that cannot be guessed.

The link is valid for twelve months. If the app is in your app register, it lasts that long.

You can change the link at any time. The old one then stops working at once.

No customer can see another customer's order.

Approved reports are locked

An approved report cannot be changed or deleted, not even by us.

If something changes, it becomes a new version next to the old one.

If you ask us to delete your details, we remove name and email. The report remains without them.

We never touch the vendor's systems

We only read what is open to everyone, like an ordinary visitor.

We follow robots.txt and read one page at a time.

Our server never fetches addresses on internal networks. This includes redirects.

The vendor never learns who ordered the review.

Payment through Stripe

Card payment is handled by Stripe. Card details never reach us.

An order counts as paid only when Stripe confirms it with a signed message.

Operations and continuity

• The database is copied every night and encrypted before it leaves the server.
• A copy is kept with another Swedish provider. The key is not on the server.
• We have restored a copy and compared it with production. Most recently on 13 October 2026.
• Our staff sign in with a password and a one-time code.
• A new version ships only when type checks and all tests pass.
• Security updates for the operating system are installed automatically.

Report a vulnerability

Write to [email protected]. We publish a security.txt following RFC 9116.

If a personal data breach affects you, we contact you without undue delay.

How we handle personal data is described in the privacy policy.