Loading
Security
Plenty of software puts a row of compliance badges in the footer and hopes nobody asks. Here is the actual position, including the parts that are not finished.
Payments are handled by a PCI DSS Level 1 payment provider. Card numbers are entered directly into the provider's hosted fields and go straight to them. Lunis never receives, processes, or stores a card number, which is what keeps us in SAQ-A scope. There is no cardholder data on our systems to breach, and no amount of trust in us is required for that to hold.
SimControl is built to run with the internet down, because a venue does not get to stop racing when a line goes out. In an offline deployment your race results, customer records, and takings live on your own hardware. Sync to the cloud is something you turn on, not something that happens by default.
A Lunis rig never asks you to forward a port and never opens an inbound listener to the internet. Connections are made outbound from the rig. There is no public door to find and no exposed service to scan for. Remote support is a separate, explicit action rather than a standing capability.
We collect the least we can and use it only to run the service and answer you. You can ask for access to your personal data, correction, an export, or deletion, and we will act on it. Details of what we collect and why are in the privacy policy.
Traffic between you and Lunis runs over TLS. The public site is served over HTTPS only.
If you believe you have found a security issue, tell us through the contact form and mark it as General. Describe what you found and how to reproduce it. We would much rather hear it from you first, and we will not go after anyone acting in good faith.
If any of these change, this page changes with them, and not before.
There is no SOC 2 Type I or Type II report for Lunis. A SOC 2 report is issued by a licensed CPA firm after an audit, and we have not been through one.
No accredited body has certified an information security management system here. We are not going to display the mark until one has.
SAQ-A applies because all card handling is outsourced to a validated provider. It is a self assessment questionnaire, not a Level 1 audit of Lunis, and we would rather say so plainly than let the letters imply more than they mean.
Running a procurement review and need something specific? Ask us. Our privacy policy covers what we collect and why.