Security & GDPR
Your HR data is some of the most sensitive in your business. We take that seriously — with UK data residency, end-to-end encryption, full audit logging, and GDPR compliance built in from day one.
Built to the standards that matter. UK-based, GDPR-ready, and certified against recognised security frameworks.
Cyber Essentials Plus
Certified against the UK government-backed cyber security standard. Covers boundary firewalls, secure configuration, access control, malware protection, and patch management.
UK data residency
All customer data is stored and processed on servers located in the United Kingdom. No data leaves the UK without your explicit consent.
GDPR compliant
Built to meet UK GDPR and the Data Protection Act 2018 from day one. Data minimisation, lawful processing, and clear data subject rights.
ISO 27001 aligned
Internal security controls follow ISO 27001 principles covering access management, incident response, change management, and business continuity.
How we protect your data. Eight layers of protection covering everything from login to audit log.
Encryption in transit
Every request is encrypted with TLS 1.3. HTTPS enforced site-wide with HSTS. No downgrade attacks possible.
Encryption at rest
Your data is encrypted at rest using AES-256. Uploaded files and database storage are both encrypted.
Multi-factor authentication
Enforce 2FA for all users via authenticator apps, passkeys, or SMS. Admin-configurable per company.
Role-based access control
Granular permissions with custom roles. Policies inherit through your org structure, so access follows your team's actual shape.
Full audit logging
Every state change is logged with who, what, when, and where. Audit logs are immutable and exportable for compliance reviews.
Session security
Sessions expire automatically, admins can revoke sessions centrally, and suspicious activity triggers re-authentication.
Anonymous reporting
Safeguarding and wellness reports support true anonymity. Identity is never exposed, even to admins.
Secure e-signatures
Digital signatures with cryptographic audit trails. Every signed document retains IP, timestamp, and user context.
Your GDPR rights, built in. Every employee gets the rights UK GDPR gives them — and they can exercise them without filing a request.
Right to access
Employees can request a full export of their personal data at any time. Admins can generate exports per employee in one click.
Right to erasure
Delete employee records when they leave, with configurable retention for legal or tax obligations. Soft-delete with permanent purge.
Right to rectification
Employees can update their own profile data. Changes are logged and auditable.
Right to portability
Export employee data in machine-readable formats (CSV, JSON) for transfer to other systems.
Security, in action. Retention schedules that enforce themselves and 2FA that blocks logins until admins enrol.
- Expiring · 255d
Audit log
7-year retention
- Expiring · 190d
Expense receipts
6-year (HMRC)
- 150d left
Employee records · ex-staff
2 years post-departure
- 28d left
Session tokens
30 days inactive
- 4d left
Soft-deleted records
30-day recovery window
01
Retention that enforces itself
Every data type has a retention clock — audit logs for seven years, expense receipts for six (HMRC), ex-employee records for two. When the clock hits zero, Luna purges the record and writes an audit entry. No manual cleanup, no quiet drift past policy.
Signing in · Sarah Mitchell
Team enrolment
- SM2FA on
Sarah Mitchell
AdminHead of Finance
- OC2FA on
Olivia Chen
AdminEngineering Lead
- TP2FA on
Tom Parker
Operations
- SMLogin blocked
Sofia Marin
AdminHR Business Partner
- HW2FA on
Hana Weiss
Finance Analyst
- JPEnrol required
Jamal Price
Warehouse
02
2FA required where it matters
Multi-factor authentication is required for every admin — no exceptions. Non-enrolled admins are blocked from login until they set up an authenticator. A team-wide enrolment grid shows who still has work to do.
Policies & agreements
Review our full legal documents for the details on data processing, cookies, and service terms.