Security & Privacy

Leenops is built with security and privacy controls at its core. This page describes implemented security features and links to the legal policy documents that govern data processing.

Security Overview

Leenops implements defense-in-depth security across all layers:

Multi-Tenancy

Workspace-scoped data model
workspace_id checks in application code and database policies
Row-level security used as a defense-in-depth isolation layer

Authentication

Email/password with bcrypt hashing
OAuth 2.0 for social login
Workspace login OTP policy for password sign-ins
SAML SSO for enterprise identity-provider login

Session Management

JWT tokens with short expiration
Refresh token rotation
Durable rate limits on sensitive authentication flows
Per-session OTP and step-up verification records for protected actions

Encryption

Data	Encryption
Data at rest	AES-256
Data in transit	TLS 1.3
API keys	AES-256-GCM
Passwords	bcrypt
Backup codes	bcrypt

Row-Level Security (RLS)

Database Policies

RLS policies across workspace-scoped tables are designed to ensure:

Users only see their workspace data
Role-based access enforced at database level
Even admin queries respect policies

Policy Example

-- Users can only see their workspace contacts
CREATE POLICY contact_isolation ON contacts
  FOR ALL
  USING (workspace_id = current_setting('app.current_workspace')::uuid);

Rate Limiting

Four-tier rate limiting on critical routes:

Tier	Requests/Minute
Anonymous	10
Standard	100
Professional	500
Enterprise	2,000

Prevents abuse and ensures platform stability.

Data Rights

Leenops provides tooling and policy terms that help customers respond to GDPR data subject requests. Customers remain responsible for determining their own legal obligations and lawful basis.

Right	Feature
Access and portability	Export and support-assisted request workflows, depending on scope
Rectification	Record editing and support-assisted correction
Erasure	Controlled account-deletion workflow with verification and completion checks
Restriction and objection	Preference, suppression, integration, and support workflows where applicable

Data Processing

Controller: Your organization
Processor: Leenops Inc.
DPA: Published at /legal/dpa; counter-signed copy available on request
Data Location: Region depends on workspace configuration and subprocessors; EU-region options are available for eligible customers

See GDPR and your data rights and How account deletion works for details.

Audit Logging

Logged Events

9 event types tracked:

Event	Description
`user.login`	Authentication events
`user.logout`	Session termination
`user.invited`	Team invitations
`user.role_changed`	Permission changes
`record.created`	Data creation
`record.updated`	Data modification
`record.deleted`	Data deletion
`settings.changed`	Configuration changes
`export.requested`	Data exports

Audit Log Details

Each entry includes:

Timestamp (UTC)
Actor (who performed action)
Action type
Target resource
IP address
User agent

Retention: 2 years

See Audit Log for more.

Compliance Status

Leenops does not currently publish a SOC 2 Type II report or ISO 27001 certificate in this repository. Do not rely on this documentation as a certification statement.

Area	Current posture
SOC 2 Type II	Not publicly certified in the repo; security controls are documented instead.
GDPR / UK GDPR	DPA, SCCs, privacy policy, subprocessor list, export/delete tooling, and audit logs support customer compliance work.
CCPA / CPRA	DPA includes service-provider terms where applicable.

Security questionnaires, architecture summaries, or DPA questions can be sent to security@leenops.com or legal@leenops.com.

Certification or audit-report availability should be confirmed directly with Leenops before it is referenced in procurement, legal, or security reviews.

Security Best Practices

For Users

Use your workspace SSO or login OTP flow when required — Follow your organization's identity policy
Use strong passwords — Unique, complex passwords
Keep email secure — Email is used for verification and account recovery
Be phishing-aware — Verify emails are from Leenops

For Admins

Principle of least privilege — Minimum necessary access
Regular access reviews — Quarterly permission audits
Offboarding — Remove departed users promptly
Configure enterprise controls — Review SAML, SCIM, domain control, IP allowlist, and login OTP
Monitor audit logs — Watch for unusual activity

Vulnerability Disclosure

Reporting Security Issues

If you discover a vulnerability:

Email security@leenops.com
Include detailed description
Provide reproduction steps
Allow 90 days before public disclosure

We respond to all reports within 48 hours.

AWS infrastructure
Managed cloud infrastructure
Geographic redundancy
DDoS protection

Backup & Recovery

Daily automated backups
30-day retention
Point-in-time recovery
Tested restoration procedures

Monitoring

24/7 security monitoring
Automated threat detection
Incident response procedures
Security team on-call

Next Steps

GDPR — Data protection details
Audit Log — Event tracking
Enterprise Security Controls - SAML, SCIM, domains, IP allowlist, and login OTP
Settings > Security - Current security settings in the app