Built to pass your security review.
Read-only connectors. AES-256 encryption. Workspace isolation. RBAC. Tamper-evident audit log. GDPR compliant. Share this page with your IT and InfoSec teams, everything they need is here.
Read-only
All connectors
AES-256-GCM
Credential encryption
Workspace isolation
Structural data boundary
GDPR compliant
EU data residency
Compliance and posture at a glance
Where we are today, stated plainly. We show what is in place and what is planned or under way rather than implying certifications we do not yet hold.
Security architecture
How LeakIQ is designed to protect your data at every layer.
Read-only connectors. No write-back.
LeakIQ connects to your systems using read-only credentials. We surface gaps, we never write, update, or delete records in your source systems. Every connector uses OAuth or encrypted API keys scoped to the minimum permissions required.
AES-256-GCM credential encryption
All connector credentials are encrypted at rest using AES-256-GCM before being stored. The encryption key is held separately from the database and is never logged. The key can be rotated at any time by updating the server environment variable, no data migration is required.
Workspace isolation
Every customer operates in an isolated workspace with a separate data partition. No customer can access another customer's data. Workspace IDs are scoped to every database query, cross-workspace data access is structurally impossible.
Role-based access control (RBAC)
A layered model: an account-level Owner (plus a delegatable Integrations grant) governs billing, users and connectors, while workspace-level Admin, Operator and Viewer roles govern recovery operations. Role changes are audit-logged, and all permission checks are enforced server-side, not in the UI layer.
Tamper-evident audit log
Every significant action (login, data access, role change, approval, recovery action) is written to an append-only audit log with actor, timestamp, and IP address. Logs are exportable for compliance review.
Data residency and subprocessors
Your data is stored at rest in the EU (Neon PostgreSQL on AWS eu-west-1, Ireland). Some processing, application compute on Vercel and transactional email, takes place in the US under Standard Contractual Clauses; nothing is stored there. Our subprocessors include Neon (database, EU), Vercel (compute), Resend (transactional email) and Stripe (billing). See leakiq.io/legal/data-transfers for the full position; a signed DPA is available on request.
Authentication and session security
Sessions are signed with a rotating HMAC secret (NEXTAUTH_SECRET). Passwords are hashed with scrypt, a memory-hard key-derivation function. MFA is available for all workspace members. Sessions expire after inactivity.
Data retention and deletion
Data is retained for the duration of the workspace subscription. Disconnecting a connector removes its credentials immediately, and full workspace deletion purges all workspace data, connector credentials and recovery records.
Common InfoSec questionnaire answers
The 10 questions we receive most often from IT and security teams during vendor review.
Do you store our financial data?
We store the minimum data needed to detect and surface revenue gaps: metric snapshots, event records, and derived issues. We do not store raw transaction records or payment card data. All data is associated with your workspace and deleted when the workspace is closed.
Can you write to our systems?
No. All connectors are read-only. LeakIQ does not send requests that create, update, or delete records in your source systems.
How are credentials protected?
Credentials are encrypted with AES-256-GCM using a secret key that is separate from the database. Credentials are never returned in API responses or written to logs.
Where is data stored?
Your data is stored at rest in the EU (AWS eu-west-1, via Neon PostgreSQL). Application compute runs on Vercel and some processing takes place in the US under Standard Contractual Clauses, but nothing is stored there. See leakiq.io/legal/data-transfers for the per-subprocessor detail.
Do you offer a DPA (Data Processing Agreement)?
Yes. Contact us at support@leakiq.io and we will provide a signed DPA within two business days.
Are you SOC 2 certified?
No. We do not hold a SOC 2 report and are not currently under audit; it is on our roadmap. Our infrastructure providers (Vercel, Neon, AWS) hold their own SOC 2 attestations, which cover their layer, not ours. Contact us for our current security posture documentation.
How do we revoke access?
Disconnect a connector from the Connected Systems page at any time, this immediately revokes token usage. Close the workspace via Settings, then Billing to purge all data.
What happens if LeakIQ is compromised?
We have an incident response plan covering detection, containment, notification (within 72 hours per GDPR requirements), and recovery. Affected customers are notified by email with a full incident report.
Can we get a penetration test report?
We are commissioning an independent, CREST-accredited penetration test; the executive summary will be available under NDA on completion. Contact support@leakiq.io.
How do we conduct a security review before connecting systems?
Start here. For deeper review, email support@leakiq.io, we respond within one business day and can schedule a technical call with your InfoSec team.
Ready to proceed with your review?
Email us at support@leakiq.io for a DPA, our penetration-test summary once available (under NDA), or to schedule a call with your InfoSec team. We respond within one business day.
Prefer to talk? Book a call.