Security / trust page — Lucidspark

Cited by

Facts read from this source

• Trust center documents Report an error

  “Our trust center includes our SOC 2, CAIQ, and SIG documentation, and more than 30 additional documents.”

• Document ownership Report an error

  “Lucid claims no ownership over any document data. You retain all intellectual property and other rights to your documents and the information they contain.”

• Encryption Report an error

  “Lucid supports HTTPS connections using TLS 1.2 or 1.3 and symmetric key lengths up to 256 (AES).”

• Encryption at rest Report an error

  “Lucid also employs encryption at rest (AES-256) to protect the secrecy of all data persisted by the application.”

• Key management Report an error

  “The cryptographic keys used to secure Lucid are protected by Amazon’s Key Management Service.”

• ISO 27701 Report an error

  “Lucid is also ISO 27701 certified.”

• DPA enterprise Report an error

  “Data Processing Addendum (for Enterprise customers)”

• Certifications Report an error

  “SOC 2 Type II ISO 27001 , opens in a new tab ISO 27701 , opens in a new tab ISO 42001 , opens in a new tab PCI (merchant certification) EU-U.S. and Swiss-U.S. Data Privacy Framework FedRAMP Certified Class C (Moderate) Cloud Application Security Assessment (CASA) IRAP Assessed at the PROTECTED Level”

• Cloud providers Report an error

  “We use best security practices for all three cloud providers that integrate with Lucid: AWS, Azure, and Google Cloud Platform.”

• Primary provider Report an error

  “Lucid is powered by Amazon Web Services (AWS), the industry’s leading provider of secure computing infrastructure.”

• Uptime guarantee Report an error

  “Lucid offers a 99.9% uptime guarantee to Enterprise customers.”

• Resilience architecture Report an error

  “We do this by replicating documents, account information, access control lists, and other persistent data across multiple availability zones using industry-standard database management systems, and failover solutions.”

• Enterprise governance features Report an error

  “These features include domain control and verification, SAML, two-factor authentication, and more.”

• Access control model Report an error

  “A simple role-based permissions system allows administrators to manage access to documents owned by the account.”

• Enterprise shield eligibility Report an error

  “Enterprise Shield is Lucid’s security add-on for Enterprise and FedRAMP Certified accounts.”

• AI optional admin control Report an error

  “AI capabilities are optional, and admins have the option to turn off these features at any time.”

• AI training policy Report an error

  “Customer data is not used to train any generative AI models available to third parties.”

• Cookies Report an error

  “Yes, Lucid collects cookies and similar technologies to personalize user experience and improve platform performance.”

• Public API Report an error

  “Yes, Lucid offers a public API that allows developers to programmatically create, read, and update documents across Lucidchart and Lucidspark.”

• Data classification Report an error

  “Lucid treats all customer data with its highest classification level, encrypting data at rest with AES-256 and in transit via TLS 1.2.”

• Document access control Report an error

  “Lucid's support team can access customer documents only when the customer explicitly grants permission via a security PIN.”

• Authentication Report an error

  “Lucid supports SAML-based SSO, SCIM provisioning, and federated identity provider integration, with email and password login available as a fallback.”

• MFA Report an error

  “MFA is supported natively as an Enterprise feature and is required internally for all privileged access to Lucid's network and customer data.”

• Govsuite fedramp Report an error

  “Lucid GovSuite is FedRAMP Certified Class C (Moderate).”

• GDPR erasure Report an error

  “Yes, Lucid supports data deletion rights under GDPR and other applicable privacy regulations.”

• Incident response Report an error

  “Yes, Lucid maintains a 24x7x365 security incident response team operating under a documented plan with defined roles and responsibilities”

• Penetration testing Report an error

  “Yes, Lucid performs penetration testing and vulnerability scanning on a scheduled basis.”

• Security training Report an error

  “Yes, all Lucid employees must complete security awareness training upon hire and annually thereafter.”

• List Report an error

  “Yes, Lucid Software uses third-party subprocessors across functions, including cloud infrastructure, analytics, and customer support, and maintains a current, publicly accessible subprocessor list.”

• Status page Report an error

  “Yes, Lucid Software publishes real-time uptime and incident updates at status.lucid.co, where users can also subscribe to email notifications”

Scores citing this record

• The Microsoft 365 Admin Integrations, import & export
• The Microsoft 365 Admin Sharing, permissions & administration
• The Microsoft 365 Admin Security, AI controls & deployment
• The Microsoft 365 Admin European sovereignty
• The Product Team Lead Canvas, templates & content
• The Product Team Lead Integrations, import & export
• The Product Team Lead Sharing, permissions & administration
• The Product Team Lead Security, AI controls & deployment
• The Product Team Lead European sovereignty
• The Public-Sector Project Lead Canvas, templates & content
• The Public-Sector Project Lead Integrations, import & export
• The Public-Sector Project Lead Sharing, permissions & administration
• The Public-Sector Project Lead Security, AI controls & deployment
• The Public-Sector Project Lead European sovereignty
• The Skeptic Canvas, templates & content
• The Skeptic Sharing, permissions & administration
• The Skeptic Security, AI controls & deployment
• The Skeptic European sovereignty
• The Works Council Member Integrations, import & export
• The Works Council Member Sharing, permissions & administration
• The Works Council Member Security, AI controls & deployment
• The Works Council Member European sovereignty
• The Works Council Member Pricing transparency
• The Workshop Facilitator Canvas, templates & content
• The Workshop Facilitator Integrations, import & export
• The Workshop Facilitator Sharing, permissions & administration
• The Workshop Facilitator Security, AI controls & deployment
• The Workshop Facilitator European sovereignty