Security & Compliance.
What your city’s finance, legal, and IT reviewers will want to know — answered honestly. We’d rather start a partnership conversation about what we don’t have yet than fudge what we do.
What data we touch
To operate the program, Lunch receives invoice metadata for invoices your city has approved for payment, and basic vendor identity information for the vendors who choose to participate. We do not receive sensitive citizen data, payroll, HR records, or anything outside the AP/vendor scope.
Invoice and vendor data is transmitted over TLS and stored encrypted at rest. Lunch’s production infrastructure runs on AWS in us-east-1.
Vendor identity verification
Vendor identity, business verification, and beneficial-ownership checks are handled through Middesk. Banking instructions provided by a vendor are verified before any payment is released.
Onboarding outreach, identity collection, and banking setup all happen on the Lunch side. Your AP team should never receive a vendor question about Lunch.
Compliance posture, in plain English
We are a small, pre-pilot company. We are not currently SOC 2 certified. We do not currently have a third-party penetration test, and we do not carry cyber-liability insurance today. Those are investments we expect to make as the program scales — and we are happy to talk through our roadmap with your IT or risk team.
What we can do today is walk through our architecture, our access controls, and our data-handling practices in detail with your reviewers, and put in writing whatever commitments your office needs to move forward.
Access control and audit
Production access is limited to a small number of named operators, authenticated with multi-factor auth. Access to invoice and vendor data is logged. For direct API integrations, we support IP allowlisting on request.
Vendor accounts in the Lunch product use multi-factor auth, and we notify the vendor on banking-instruction changes.
For city finance, legal, and IT reviewers
We’ll work with whoever your office assigns. Common artifacts we share during a partnership review:
- Architecture and data-flow overview
- Sample notice of assignment for vendor receivable purchase
- Sole-source justification template
- Sample MOU and partnership agreement
- Vendor-onboarding flow walkthrough
- Direct conversations with the founders, on the record
Email info@lunchpayments.comand we’ll route to the right person on our side within one business day.
Ask us anything your reviewers need.
We’d rather have one honest call than a stack of generic security PDFs. Bring the questions your office is going to ask.