Product · Features
Everything you need to ship audit-ready software.
Lumora is the connective tissue between your stack and your auditor. Continuous evidence, policy-as-code, audit log API, and frameworks for every compliance regime.
Evidence
Continuous evidence, not screenshots
Forty integrations, hourly polling, signed events. Your auditor sees a stream — not a folder of last quarter's PNGs.
- 40+ continuous integrations · AWS · GCP · Azure · Okta · GitHub · Datadog · Snowflake
- Hourly polling cadence · 24-hour coverage gap maximum
- Cryptographically signed events with 7-year retention
Hourly polling · last evidence 4 minutes ago
Policy
Policy as code, with guardrails
Write policies in Rego or our typed DSL. Diff them in pull requests. Test them against historical evidence before they ship.
- Native Rego support + a typed DSL for non-engineers
- Pull-request diffs against the live evidence corpus
- Backwards-test against the last 12 months of events
Frameworks
Every framework your auditor reads
SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP, GDPR, and 12 more. Map your existing controls in minutes; we suggest the gaps.
- 18 built-in framework templates · always-current
- AI-suggested mappings from your existing control library
- Cross-framework reuse: one control, multiple frameworks
132 controls reused across 6 frameworks
Audit log
An audit log your SIEM can query
Stream every privileged action to your SIEM, your warehouse, or a webhook. Sign and verify with chain-of-custody guarantees.
- Push or pull · webhook, Kafka, or REST
- Chain-of-custody signatures verifiable offline
- Per-tenant, per-user, per-control queryability
Integrations
Connects to the stack you already run.
40+ continuous integrations. AWS, GCP, Azure, Okta, GitHub, Datadog, Snowflake — all polled hourly with 24-hour coverage SLA.
Frameworks
Every framework your auditor reads.
Policy as code
Policies your engineers can review like any other PR.
Define controls as queries against your live evidence corpus. Diff them in pull requests. Test them against the last 12 months of events before you ship.
import { control, query } from '@lumora/policy';
export const accessReview = control({
id: 'CC6.3',
name: 'Quarterly access review',
framework: ['SOC2', 'ISO27001'],
evidence: query`
SELECT actor, target, granted_at
FROM permission_grants
WHERE granted_at > NOW() - INTERVAL '90 days'
`,
passWhen: (rows) => rows.every(reviewed),
cadence: 'hourly'
});See every feature, in your stack.
14-day free trial. Connect AWS, GitHub, and your IdP. We'll show you your first evidence within 12 minutes.