Architecture
Zero trust is a property of every boundary
HTTPS, a VPN or a password on its own is not zero trust. In Lumen, each service, connection, operator session and tenant boundary has to prove who it is and what it may do — every time.
Content is encrypted before it reaches us
The strongest control is architectural: servers never receive message keys, so no server compromise, insider or subpoena can produce plaintext of encrypted rooms from server data.
Separated services and credentials
Website/portal, operator console, worker and homeserver are separate processes with separate secrets. The public portal process doesn't contain admin routes, and only the console and worker hold the homeserver admin token.
Private operator path
The console listens only on a private port reachable through an SSH tunnel or WireGuard, checks a gateway secret on every request, requires operator MFA and re-authentication for sensitive actions.
Tamper-evident audit log
Every operator action is written to an append-only, hash-chained log that the database refuses to edit. Destructive actions need typed confirmation.
Short-lived, revocable credentials
OIDC codes live 60 seconds, tokens 5 minutes. Sessions expire when idle and can be ended from the security center. Secrets are generated per installation, stored in root-only files and rotated by the tooling.
Hardened by default
Containers run as unprivileged users with dropped capabilities and no new privileges. The Docker socket is never exposed to any service. Only ports 80, 443 (and optional TURN/WireGuard) are open.
What zero trust does not mean here
We still operate a server that you rely on for availability and that sees metadata (see what the server can see). Zero trust limits what any single component, credential or person can do — it doesn't make the operator disappear. If you need to remove the operator from the picture entirely, run your own server: it's the same software.