Security & Compliance
Security and compliance controls for Telumin — encryption in transit and at rest, data residency, access management, and a full evidence audit trail. Telumin holds no broker credentials — there are none to secure.
Overview
Telumin holds no broker credentials — there are none to secure. If you import your portfolio, Telumin holds your ticker symbols, quantities, written theses, and cashflows you entered. Everything is designed around minimising what that is. Evidence is namespaced per user, encrypted at rest, and deleted for real in one click.
Compliance & Certifications
EU data residency
Cloud data lives in the EU (Frankfurt, Germany). AI inference for signal generation runs on local models on Telumin’s own hardware.
GDPR rights, exercised in-product
One-click export of everything as JSON. Delete is a real cascade — every record, including agent tokens — and it is tested.
Structural blast-radius cap
No broker connection, no credentials, no transactions. A worst-case breach exposes tickers and written theses — never account access, never money.
Certifications: none claimed
No SOC 2 or ISO 27001 certification yet — we would rather say so than imply an audit that hasn’t happened. The architecture above is the security posture; formal audits follow customer demand.
Security Architecture
- End-to-end encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
- Scoped OAuth 2.1: Agent access uses short-lived scoped tokens with PKCE — revocable per user, consent per scope
- Data residency: EU by default (Frankfurt, Germany); other regions via private deployments only
- Full evidence audit trail: Document → signal → diary → alert, exportable in one click
- Tenant isolation: Per-org tenancy with user-scoped queries, guarded by an API-level test suite
- No execution path: Propose-never-execute is architecture — there is no order-routing code to compromise