The platform behind every Lumzi product.
ITops, LMS, and SMS are different products with one foundation: agent-first AI you can trust, tenant isolation enforced at the database, your own AI keys with zero markup, and a single design system. Build a product once — it inherits all of it.
AI suggests.
Humans decide.
Every AI surface is an agent — it plans, calls typed tools, and verifies before it produces an artifact. Every artifact carries Provenance: the source it drew from, shown as an iris underline and a citation chip. High-stakes actions — grades, sends, publishing — stay human-in-the-loop and can never be auto-fired.
Here’s a drafted replyKB-0094 for the open ticket — grounded in a known fix, queued for your review. Accept it, edit it, or reject it; nothing leaves the queue on its own.
One database. Every row knows its tenant.
Each product runs on one pooled Postgres database, and every tenant-owned row carries a tenant id. Isolation is enforced two ways at once: application-level scoping on every query, and Postgres row-level security with a per-request tenant context derived from the session — never from client input. A cross-tenant access test ships in CI and fails closed, so a regression can’t quietly leak data.
App-level scoping
Every query is scoped to the active tenant; reads and writes by primary key alone are never allowed.
Postgres RLS
FORCE row-level security with a per-request app.tenant_id — a database-layer backstop, not just route guards.
Session-derived context
The tenant is resolved from the session or verified host, so a forged request can't widen its own scope.
Fails closed in CI
A cross-tenant test asserts no row crosses the boundary — the build breaks before the leak ships.
Your model. Your key. Zero markup.
AI is opt-in per tenant. Turn it on and paste your own provider key (Anthropic or OpenAI) — your inference bills directly to your contract, never marked up per token. Keys are encrypted at rest and resolved per request. And the product is fully functional with AI off: authoring, the service desk, fees, grading, and catalogues all work without a key — the agentic surfaces simply stay hidden until you switch them on.
Per-tenant toggle
Each workspace decides whether AI is on at all.
Billed to your key
When inference gets cheaper, your cost drops the same day.
Keys sealed at rest
Stored with AES-256-GCM; never logged, never client-side.
Full product without AI
Core workflows never depend on a model being present.
The controls your security team will ask about.
Built into the platform, not bolted on for the deal review — and inherited by every product on it.
Encryption at rest
AES-256-GCMTenant secrets — provider keys, SMTP passwords, integration tokens, license keys — are encrypted in the database and decrypted only on the server, only at the moment of use. They never reach a client bundle, log line, or error message.
Audit log on every write
Actor · IP · diffEvery create, update, and delete records who did it, from where, and what changed. The agent's writes appear in the same trail a human's do — no silent mutations.
Server-side RBAC
Deny by defaultEvery server action and API route authorizes before it touches data. Permissions are checked on the server for every request — the UI hiding a button is never the control, and object-level ownership is verified to prevent IDOR.
GDPR & DPDP ready
Consent · erasureData-subject export and structured right-to-erasure are built in. Minors' PII is consent-gated and age-aware; personal data is never sent to an external model without consent or anonymization.
Cobalt is the product. Iris is the AI.
Every product is built on the shared @lumzi/brand system: Inter for UI, JetBrains Mono for data, Newsreader for reading, and WCAG 2.2 AA throughout. Two colours carry meaning — and they’re never confused.
The primary, interactive colour for every product surface. Tenants can white-label it to their own brand colour — the whole product re-skins without breaking layout or contrast.
Reserved for agentic surfaces and Provenance. Iris is locked line-wide — it’s never white-labelled — so wherever you see it, you know an agent is at work and a human is in the loop.
One foundation. Trusted AI on top.
Pick a product and you inherit the whole platform — isolation, BYOK AI, Provenance, and the audited guardrails that keep humans in the loop.
free workspace · no credit card · cancel any time