Built to pass your security review.
Read-only connectors. AES-256 encryption. Workspace isolation. RBAC. Tamper-evident audit log. GDPR compliant. Share this page with your IT and InfoSec teams, everything they need is here.
Read-only use
No write path, any connector
AES-256-GCM
Credential encryption
Workspace isolation
Structural data boundary
GDPR compliant
EU data residency
Compliance and posture at a glance
Where we are today, stated plainly. We show what is in place and what is planned or under way rather than implying certifications we do not yet hold.
Security architecture
How LeakIQ is designed to protect your data at every layer.
Read-only connectors. No write-back.
LeakIQ only ever reads. We surface gaps and never write, update or delete a record in your source systems, and no code path in the platform could. Where a provider offers read-only scopes we take the narrowest that works; where one does not publish a read-only scope covering the records we need, the grant is broader than our use of it, and leakiq.io/trust/access says which connectors those are.
AES-256-GCM credential encryption
All connector credentials are encrypted at rest using AES-256-GCM before being stored. The encryption key is held separately from the database and is never logged. Rotating the key is a planned operation rather than a drop-in change: stored credentials are encrypted with the current key only, so a rotation requires re-encrypting them, and connectors would need reauthorising if it were changed without that step.
Workspace isolation
Every customer operates in an isolated workspace. Workspace IDs are scoped to every database query, and membership is verified server-side before a workspace resolves, so a request cannot reach another customer's data. That isolation is enforced in application code and by review rather than by a database-level rule.
Role-based access control (RBAC)
A layered model: an account-level Owner (plus a delegatable Integrations grant) governs billing, users and connectors, while workspace-level Admin, Operator and Viewer roles govern recovery operations. Role changes are audit-logged, and all permission checks are enforced server-side, not in the UI layer.
Tamper-evident audit log
Every significant action (data access, role change, approval, recovery action) is written to an append-only audit log with actor and timestamp. Entries are hash-chained, so a deleted, reordered or altered entry is detectable by anyone who can read the log, without needing to trust us. The chain covers the actor, action, target, timestamp and ordering; the descriptive detail attached to an entry sits outside it. To be precise about the threat it addresses: the chain is a published hash, not a secret-keyed one, so it detects tampering by anyone without direct write access to the database itself. Logs are exportable for compliance review.
Data residency and subprocessors
Your data is stored at rest in the EU (Neon PostgreSQL on AWS eu-central-1, Frankfurt), and application compute runs in the EEA too: Vercel serverless functions are pinned to the fra1 (Frankfurt) region, co-located with the database. Several supporting operations take place in the US under Standard Contractual Clauses and the UK Addendum: transactional email, our own billing, rate limiting and, where a workspace enables it, AI-assisted drafting. Error monitoring stores in the EEA, with US parent-company support access covered by the same safeguards. The complete register, with what each receives and where, is at leakiq.io/legal/sub-processors. See leakiq.io/legal/data-transfers for the full position; a signed DPA is available on request.
Authentication and session security
Sessions are signed with an HMAC secret held only in the deployment environment, never in the database or the repository. Passwords are hashed with scrypt, a memory-hard key-derivation function. MFA is available for all workspace members. Sessions expire after inactivity.
Data retention and deletion
Data is retained for the duration of the workspace subscription. Disconnecting a connector removes its credentials immediately, and full workspace deletion purges all workspace data, connector credentials and recovery records.
Common InfoSec questionnaire answers
The 10 questions we receive most often from IT and security teams during vendor review.
Do you store our financial data?
Yes, and it is worth being precise because this page previously said otherwise. We store the invoice, payment, credit-note and subscription records read from your systems, one row per source record with its source reference, plus the metrics and issues derived from them. That is what makes an issue traceable back to the record it came from. We do not store cardholder data: card processing stays with your payment provider and we never see it. All data is associated with your workspace and deleted when the workspace is closed.
Can you write to our systems?
No. LeakIQ only ever reads: there is no code path in the platform that creates, updates or deletes a record in a connected system, and the only write-shaped calls we make are OAuth token exchanges with the provider. Where a provider offers read-only scopes we take them, as with Stripe, Xero and GoCardless. Intuit and Salesforce publish no read-only scope covering the records we need, so the grant you approve for those two is broader than our use of it. See leakiq.io/trust/access for the per-connector detail.
How are credentials protected?
Credentials are encrypted with AES-256-GCM using a secret key that is separate from the database. Credentials are never returned in API responses or written to logs.
Where is data stored?
Your data is stored at rest in the EU (AWS eu-central-1, via Neon PostgreSQL), and application compute runs in the EEA too: Vercel serverless functions are pinned to the fra1 (Frankfurt) region. Several supporting operations take place in the US under Standard Contractual Clauses and the UK Addendum: transactional email, our own billing, rate limiting and, where enabled, AI-assisted drafting. Error monitoring stores in the EEA. See leakiq.io/legal/data-transfers for the per-subprocessor detail.
Do you offer a DPA (Data Processing Agreement)?
Yes. Contact us at support@leakiq.io and we will provide a signed DPA within two business days.
Are you SOC 2 certified?
No. We do not hold a SOC 2 report and are not currently under audit; it is on our roadmap. Our infrastructure providers (Vercel, Neon, AWS) hold their own SOC 2 attestations, which cover their layer, not ours. Contact us for our current security posture documentation.
How do we revoke access?
Disconnect a connector from the Connected Systems page at any time, this immediately revokes token usage. Close the workspace via Settings, then Billing to purge all data.
What happens if LeakIQ is compromised?
We have an incident response plan covering detection, containment, notification (within 72 hours per GDPR requirements), and recovery. Affected customers are notified by email with a full incident report.
Can we get a penetration test report?
Vendor selection is in progress: a CREST-accredited firm has been identified and the test is not yet booked. When it completes the executive summary will be available under NDA. Contact support@leakiq.io.
How do we conduct a security review before connecting systems?
Start here. For deeper review, email support@leakiq.io, we respond within one business day and can schedule a technical call with your InfoSec team.
Ready to proceed with your review?
Email us at support@leakiq.io for a DPA, our penetration-test summary once available (under NDA), or to schedule a call with your InfoSec team. We respond within one business day.
Prefer to talk? Book a call.