This page says how Lima secures your data, who can see what, what leaves your instance and what stays inside, how privacy requests are handled, how reliable the service has been, and which certifications are held or in progress. Everything is stated with a date, including the things still in progress. The Backbone adds two sections: the SAP and Oracle extraction statement, and the audit model for every write into an ERP.
Each customer runs in a single-tenant instance. The layers below are the same in Lima's cloud, in your private cloud and on your own machines.
| Layer | What is done | Detail |
|---|---|---|
| Tenancy | One instance per customer | Your own VPC, database, storage and keys; nothing shared with another customer. |
| Encryption | At rest with your keys; in transit with TLS | Storage, database and backups encrypted with keys in a key management service you control; TLS 1.2 or later on every connection. |
| Network | Private connectivity to your systems | PrivateLink to SAP; private link or VPN to Oracle and databases; a web application firewall in front of the user interface and APIs; no other inbound path. |
| Secrets | A vault, referenced | Credentials are stored in the vault and referenced by pipelines and connectors; a key never lands in a pipeline definition or a log. |
| Availability | Three availability zones | Services and storage spread across three zones with circuit breakers; query workers scale from 4 to 12. |
| Change | Zero-downtime upgrades; promotion through Git | Configuration moves from test to production through reviewed changes; eight upgrades to date without downtime on the showcase estate. |
The same access policy applies to a person asking a question, a dashboard, a pipeline loading a target and an agent proposing an action.
Roles and attributes. Role-based rules say what a role may do. Attribute-based rules filter rows and mask columns by who is asking: a 3PL partner sees only its own shipments; a finance lead sees revenue that a supply-chain director's view marks as blocked.
The same question, three answers. On the showcase estate the same ChatLima question from three people returns three correctly filtered answers and one audit record. The filter is applied at the data tier, before an answer is composed.
Agents and pipelines are identities too. An agent receives the least privilege its job needs, tool by tool. A pipeline loads only what its role may read, and a write-back uses an ERP user with the authorisations for that object and nothing else.
| Control | What it means |
|---|---|
| RBAC | Role-based access: what a role may do. |
| ABAC | Attribute-based access: which rows and columns a person, pipeline or agent may see, decided by attributes such as customer, region or cost centre. |
| Masking | A column shown as blocked or partially hidden by policy; the policy is stated in the answer. |
| Audit log | An append-only record of every query, load, write and approval, exportable. |
| SSO and SCIM | Sign-in through your identity provider (SAML 2.0); users provisioned and removed by SCIM. |
Business users can co-draft rules and agent definitions with an external language model. The boundary is a policy, enforced by the platform and shown on screen at the moment of use.
Table names, column names, definitions from the catalog, the text you type, and the structure of the rule or agent you are drafting. The handshake that attests the boundary is shown before the session starts.
Every row of business data, every query result, every credential, and every action an agent takes. The internal engine runs the rule or the agent; the external model only helped write it.
The same boundary applies to ChatLima: the question is answered by Lima's engine on your data; an external model is used only where you have enabled it for drafting.
Buyers of data-movement software ask two questions first: what does it touch in the ERP, and is that allowed? This statement answers both, for SAP and for Oracle.
Table reads through a named, released function module (the module is named in the signed statement). BAPIs and released function modules for business objects and for every write-back. Released CDS views on S/4HANA, including delta-enabled views. Change pointers, table-level change capture and extractor delta queues for incremental reads. IDocs where the process uses them. Released OData APIs on BTP and RISE editions.
What Lima leaves out: the ODP framework's RFC interface (SAP Note 3255746); RFC_READ_TABLE in production (SAP Note 382318); reading the HANA database log (SAP Note 2971304). No add-on, transport or ABAP program is installed in SAP.
Partitioned JDBC reads within a connection cap agreed with the database administrator. Changed rows by the standard last-update columns. LogMiner only where the DBA enables supplemental logging and grants access. Oracle Fusion Cloud through BI Cloud Connector extracts and released REST APIs. Write-back through the open interface tables and their import programs, through public PL/SQL APIs and, for Fusion Cloud, through REST and file-based import; the program's result or the API response is the confirmation.
What Lima leaves out: direct writes to application tables; undocumented internal APIs.
A write into SAP or Oracle is a transaction in a system of record. Lima treats it as one: it is keyed, it is confirmed by the ERP before it counts as done, it is reconciled, and it is recorded in a ledger you can export.
| Write key | Target · object | Interface | Response | Reconciled | Owner if rejected |
|---|---|---|---|---|---|
| WB-2026-0912-000418 | S/4HANA · planned order | BAPI_PLANNEDORDER_CREATE | confirmed 0000012041 | yes | — |
| WB-2026-0912-000419 | S/4HANA · planned order | BAPI_PLANNEDORDER_CREATE | rejected: plant 1200 closed | held | planner, plant 1200 |
| WB-2026-0912-000420 | Oracle EBS · requisition | PO_REQUISITIONS_INTERFACE_ALL | imported · request 8841207 | yes | — |
| WB-2026-0912-000421 | Oracle EBS · forecast | MRP_FORECAST_INTERFACE | imported · request 8841208 | yes | — |
| WB-2026-0912-000422 | S/4HANA · material (country code) | BAPI_MATERIAL_SAVEDATA | confirmed | yes | — |
Illustrative rows. The structure of the ledger is real; the values are from the showcase estate. Interface names per object are being confirmed with engineering.
A pipeline moves data between your systems inside your instance, your private cloud or your own machines. Lima does not route your data through a shared service. A landing zone in your object storage is yours; a copy in your warehouse is yours; nothing is retained by Lima beyond the run logs and the reconciliation reports you keep.
Support access to your instance is granted by you per session, for a stated purpose, and every action taken is in the audit log. Lima staff do not hold standing access to customer data.
| Item | How it works | Evidence |
|---|---|---|
| Erasure requests | A documented workflow locates a person's records across the connected systems, executes the erasure or masking where policy allows, and records the outcome for the data protection officer's signature. | 47 minutes from execution to sign-off on the showcase estate (847 records) |
| Data residency | The instance runs in the region you choose; data does not leave it. The showcase estate runs in eu-west-1. | Region list published with the deployment page |
| Data processing agreement | Available on request, with the sub-processor list. | Sub-processor list: to be published |
| Retention | Run logs, reports and audit records are retained for the period you set; business data stays in your systems; Lima keeps only the run logs and reports you choose to retain. | Retention settings per instance |
Uptime. 99.9% since June 2025 on the showcase estate. Recovery. A recovery point objective of four hours and a recovery time objective of two hours; the last test recovered in 1 hour 48 minutes. Zones. Three availability zones with circuit breakers; if a zone fails, query workers scale from 4 to 12 in the remaining two. Incidents. Summaries are posted on the status page within one working day, with cause and remedy.
The strip shows the last 90 days on the showcase estate: one degraded day (amber) and one planned maintenance window (blue).
| Item | Status | Detail |
|---|---|---|
| SOC 2 Type II | In progress | Audit window: to be confirmed and published here. The report is provided under NDA when issued. |
| ISO 27001 | Planned | Target: to be confirmed and published here. |
| Penetration testing | To confirm | Cadence and the most recent test date to be published; the summary is in the security packet. |
| SAP certification | Decision Q4 2026 | Integration certification or interoperability review through SAP's program; the extraction statement above stands either way. |
| GDPR | Available | Data processing agreement and erasure workflow; sub-processor list to be published. |
| Planning-vendor programs | In progress | Kinaxis PartnerLink application; o9 and OMP planned Q1 2027. Status on the partners page. |
Network and tenancy diagrams, encryption and key management, access-control model, secrets handling, change management.
SOC 2 report under NDA when issued; penetration-test summary; DPA and sub-processor list.
The signed SAP and Oracle extraction statement, the write-back audit model, the standards conformance matrix with dates.
Responses to the common security and procurement questionnaires, organised by the questions buyers ask.
Requested through the demo form with the security option; delivered within two working days.
Row data does not. Metadata such as table and column names may be sent to an external model when a user co-drafts a rule or an agent, and the handshake is shown before that session starts.
Only in a support session you grant for a stated purpose, and every action in it is in the audit log. There is no standing access.
The ledger records the key, the BAPI or IDoc call, SAP's response and the reconciliation; a rejected write is held with its reason and its owner. You can export the ledger at any time.
SOC 2 Type II is in progress with an audit window to be published; ISO 27001 is planned; the SAP certification tier is decided in Q4 2026. The table above is updated as each changes.
Architecture, policies, attestations, the Backbone statements and the answer library, within two working days.
