Security
Luna asks for access to accounts that matter, so here is what protects them — described as mechanisms rather than adjectives, including the parts that are still on the roadmap.
Last updated 9 September 2026
The least access that works
The strongest control is the one where there is nothing to take. Luna asks for read-only access everywhere, and for the narrowest read it can do the job with.
| Connection | What Luna can do | What it cannot |
|---|---|---|
| Google Search Console | Read impressions, clicks, position and queries | Change anything, or see any other Google service |
| Google Analytics | Read sessions and conversions per page | Change configuration, or read other properties you did not grant |
| Shopify | Read products, collections, pages and themes | Read orders or customers, or write anything at all |
| Your website | Fetch public pages, as a search engine would | Reach anything behind a login |
Luna asks for no write access anywhere. When the feature that applies approved changes ships, it will ask then — at the point it can actually do something with the permission, not before.
One customer cannot reach another
Isolation is enforced by the database itself, not by remembering to add a filter. Every table holding customer data has row-level security switched on, and a query that forgets its organization returns nothing rather than returning everything. The rule is checked automatically: the build fails if a table carrying an organization is added without it.
The tables holding access tokens go further. They have security switched on and no read policy at all, so no browser session can read them under any circumstances. The only way in is a small, audited database function that makes the permission check itself.
Tokens are encrypted before they are stored
Access tokens for your connected accounts are encrypted with a key that lives in the application environment and is never written to the database. A leaked database dump is therefore a file of ciphertext rather than a set of live connections to your Google account.
Disconnecting deletes the credential rather than flagging it as unused. Reconnecting is a fresh grant, which is also why it requires your consent again.
Payments and webhooks
Card details never reach Luna; Stripe handles payment and Luna stores only the resulting subscription state. Incoming payment webhooks are verified against Stripe’s signature over the exact bytes received, using a constant-time comparison and a timestamp window, before anything in the message is trusted. An unverified webhook is refused, not logged and applied. Behind that, the database accepts a plan change only from Luna’s own server, which proves itself with a key no customer session holds.
Crawling your site
Luna fetches the site you give it, and only public addresses. It resolves every hostname itself, refuses private, loopback, link-local and cloud-metadata addresses however they are written, re-checks every redirect, and connects only to the address it checked. Each page is read up to a fixed size and dropped beyond it.
Roles
Owner, admin, member and viewer, enforced in the database as well as the interface — a viewer cannot change anything by any route, including a hand-crafted request. Billing is restricted to owners, connecting accounts to owners and admins, and an admin cannot make anyone an owner or admin, themselves included.
What Luna does not have yet
A security page that lists only strengths is a sales page. These are real and current:
- No SOC 2 or ISO 27001 report. Luna is early. If your procurement requires one, say so and we will tell you honestly where we are rather than gesture at a roadmap.
- No customer-managed encryption keys and no single-tenant deployment.
- No SSO or SCIM beyond Google sign-in, and no two-factor sign-in yet.
- No published penetration test. When one is done, it will be linked here.
Reporting something
If you think you have found a vulnerability, write to security@gambix.io. We will confirm receipt within two business days and will not take action against anyone who reports in good faith and does not access other customers’ data.
What Luna collects and who else can see it is on the privacy page.