Passkey and password authentication
Lucion Identity supports phishing-resistant passkeys/WebAuthn and verified-email password sign-in, with carefully protected recovery boundaries.
SECURITY
Trust has to be designed, not advertised.
The General Availability release documents the active security model and the assurance work that remains, without claiming protections or certifications that have not been independently verified.
Least-privilege authorization
Users, apps, service identities, and Lyra receive only the scopes and organization permissions required for the requested action.
Session and secret hygiene
Session tokens, OAuth secrets, signing material, recovery data, and credentials stay out of browser storage, source, logs, and client bundles.
Auditable AI delegation
Lyra actions require user/org context, explicit scopes, target application authorization, and an audit event with outcome.
SECURITY ASSURANCE
What is verified now — and what is not.
These statements are intentionally conservative and do not substitute for independent certification or testing.
Certifications & complianceNot claimed
No SOC 2, ISO 27001, HIPAA, or other independent certification is claimed for Lucion Identity.
Transport & storageOperational
Production identity traffic is served over HTTPS. Server-side identity records and protected credential representations remain behind the approved Cloudflare runtime boundary.
Data residencyConfiguration-specific
Storage location and residency commitments depend on the approved deployment configuration and applicable Lucion privacy terms; no broader residency promise is made here.
Internal access controlsEnforced in contract
Production paths require least privilege, organization boundaries, scoped application access, auditable administrative actions, and explicit authorization for AI agents.
Vulnerability disclosureAction required
A verified public security-reporting channel and responsible-disclosure process still need to be published and tested.
Incident historyNo material incidents recorded
Material service incidents should be reflected through the Status and security communication process as they occur.
Penetration testingNot claimed
No independent production penetration-test report is claimed. Third-party testing remains recommended for ongoing assurance.
Current release boundary
v6.6.6 is a General Availability release. Verified-email enrollment, passkey and password authentication, secure sessions, recovery safeguards, OAuth/OIDC, organization authorization, SCIM foundations, and scoped Lyra delegation remain controlled by explicit runtime gates and production approval; Lyra action execution remains separately constrained.