Technical documentation
LeakIQ technical reference
This document is for engineering, IT, security, data, compliance and legal teams conducting pre-procurement evaluation of LeakIQ. It covers how the platform is built, how data flows through it, how credentials are protected, and how LeakIQ meets enterprise security and regulatory requirements.
For questions not answered here, including security questionnaire completion, data processing agreements or architecture review calls, contact support@leakiq.io.
See also the Security overview for a plain-English summary, and the Trust Centre for all security, privacy and compliance documentation in one place.
Security posture
LeakIQ is designed to be safe to connect to your financial systems and straightforward to approve through an IT or InfoSec review. The key commitments:
Read-only connectors. No write-back.
LeakIQ connects using read-only credentials. We surface gaps, we never create, update or delete records in any connected system.
AES-256-GCM credential encryption
All connector credentials are encrypted before storage. The encryption key is held separately from the database and is never logged or returned in API responses.
Workspace isolation
Every workspace has a separate data partition. Workspace IDs are scoped to every database query, cross-tenant data access is structurally impossible at the ORM layer.
Layered RBAC
Account-level Owner and a delegatable Integrations grant govern billing, users and connector setup; workspace-level Admin, Operator and Viewer roles govern recovery operations. All enforced server-side and audit-logged, no client-side-only gating.
Tamper-evident audit log
Every action is written to an append-only log with actor identity and timestamp. The log implements a hash-chain integrity model, retrospective tampering is detectable.
GDPR compliant
Data is stored in the EU (Neon PostgreSQL, AWS eu-west-1, Ireland). LeakIQ acts as a data processor. A signed Data Processing Agreement is available on request.
Authentication & session security
Sessions are signed with a rotating HMAC secret and stored in HTTP-only cookies. Passwords are hashed with scrypt (memory-hard KDF). MFA is available for all workspace members.
Data retention & deletion
Data is retained for the workspace subscription lifetime. Deleting a connection removes its encrypted credentials immediately. Full workspace deletion purges all records.
Architecture
LeakIQ is a cloud-native SaaS application deployed on Vercel's serverless infrastructure. There are no persistent application servers, each request is handled by an ephemeral serverless function that spins up on demand and is discarded after the response. This eliminates an entire class of infrastructure-level attack surface.
| Layer | Technology | Notes |
|---|---|---|
| Frontend & API | Next.js 15 App Router | React Server Components; server actions for mutations |
| Deployment | Vercel (serverless) | No persistent servers; ephemeral per-request execution |
| Database | Neon PostgreSQL 16 | Managed serverless Postgres; connection pooled |
| ORM | Prisma 5 | Type-safe query builder; no raw SQL in application code |
| Session management | NextAuth v4, JWT strategy | Sessions in signed, encrypted HTTP-only cookies only |
| Email delivery | Resend | Transactional email only; no marketing email |
| Billing | Stripe | Subscription management; no card data touches LeakIQ servers |
All routes under /operations/* enforce authentication at the layout level, unauthenticated requests are redirected to /login before any data is fetched. Workspaces with a paused subscription are redirected to the billing page before any operational data is accessible.
Connectors
LeakIQ connects to your existing billing, accounting, payment and CRM systems using read-only credentials. LeakIQ never writes back to any connected system. Each connector is individually managed, you can add, pause or remove any connection at any time.
Five native connectors are live today, Stripe, Xero, QuickBooks, Salesforce and GoCardless, alongside a generic CSV / JSON finance import that runs the same detection on an export from any other system. The remaining connectors below are in progress and are marked accordingly.
| Connector | Category | Auth method | Data LeakIQ reads (read-only) | Status |
|---|---|---|---|---|
| Stripe | Billing & payments | OAuth 2.0 (Stripe App) | Invoices and payment intents, including failed collections | Live |
| Xero | Accounting | OAuth 2.0 | Invoices and payments | Live |
| QuickBooks Online | Accounting | OAuth 2.0 | Invoices and payments | Live |
| Salesforce | CRM | OAuth 2.0 | Opportunities and contract renewals | Live |
| GoCardless | Direct debit | API access token | Mandates, payments, payment failures | Live |
| CSV / JSON import | Any accounting, billing, CRM or ERP export | Signed file upload or POST | Any invoice, payment or subscription rows you export | Live |
| HubSpot | CRM | OAuth 2.0 | Deals, contacts, renewal activity, pipeline events | In progress |
| NetSuite | ERP / accounting | OAuth 2.0 (token-based) | Invoices, customer payments, AR activity | In progress |
| Zuora | Subscription billing | OAuth 2.0 | Subscriptions, invoices, payment failures | In progress |
| Sage Intacct | Accounting | API credentials (session) | Invoices, payments, AR ageing | In progress |
| Chargebee | Subscription billing | API key | Subscriptions, invoices, dunning events | In progress |
| Braintree | Payments | API key | Transactions, disputes, chargebacks | In progress |
| Zapier | Automation / webhook | Webhook secret (timing-safe verified) | Any event payload from Zapier-connected apps | In progress |
Live OAuth 2.0 connectors (Xero, Salesforce, QuickBooks) use short-lived access tokens with automatic refresh token rotation. Stripe connects through the Stripe App using OAuth, and GoCardless uses a read-only API access token, in both cases a scoped, read-only credential your team authorises and retains full control over. You can revoke access at any time by rotating or deleting the credential in the source system, LeakIQ will immediately stop making calls once it is invalid.
Removing a connection from the Connected Systems page deletes the encrypted credential immediately. LeakIQ will make no further API calls to that system.
What LeakIQ detects
LeakIQ runs a fixed library of deterministic revenue-leak detectors over the read-only financial records it ingests. There is no machine learning and no black box, each finding maps to one of the signals below and is surfaced with the source record attached so your team can verify it. LeakIQ does not detect tax or VAT errors, currency or FX loss, usage or metering discrepancies, and it does not read contracts or reconcile bank feeds.
| Signal | What it flags | Notes |
|---|---|---|
| Overdue invoice | Invoice past its due date and still unpaid, including an aged unpaid invoice with no due date once it is well past any normal payment term | |
| Part-paid invoice | Invoice partly paid, remainder overdue and never chased | |
| Failed payment | Card payment declined or failed | Suppressed if a later payment recovered it |
| Failed direct debit | GoCardless direct debit failed | Suppressed if a later payment recovered it |
| Disputed payment / chargeback | Payment contested by the customer | Time-sensitive |
| Duplicate charge | Same customer charged the same amount twice, both succeeded | Possible duplicate, confirm before refunding |
| Duplicate invoice | Same customer invoiced the same amount twice in a short window, or one document number reused across invoices | Possible duplicate, confirm before crediting |
| Unapplied cash / overpayment | Customer paid more than they were invoiced | |
| Unused credit note | Customer holds a credit while open invoices could be cleared by it, or a credit beyond any open balance that is effectively refund-due | |
| At-risk renewal / silent churn | A regular billing cadence has gone quiet and the next invoice is overdue to appear | |
| Price never moved / missed uplift | Same recurring amount billed across anniversaries | Amount is an estimate; LeakIQ cannot see contracts |
| Discount creep | Recurring price stepped down and never recovered | Amount is an estimate |
| Stalled deal | CRM opportunity past its close date and still open |
Every signal above runs identically whether the data arrives from a live connector or from a CSV / JSON finance export, detection is source-agnostic. Amounts for the two pricing signals (price never moved, discount creep) are estimates, because LeakIQ observes billing history but never sees the underlying contract. Duplicate charge and duplicate invoice are surfaced as possible duplicates for a human to confirm before any refund or credit.
Every finding also carries a confidence score. It is deterministic, not a machine-learning probability, and reflects how directly the signal is observed in your data. A fact read straight from the ledger (an invoice that is overdue, a direct debit that failed) scores highest. A finding that needs matching (an unapplied payment, a duplicate invoice) scores a little lower. A forward-looking estimate (an expected-but-unbilled renewal, a stalled deal) lower again. Scores are capped so LeakIQ never claims total certainty, and every issue links back to the source record behind it.
Authentication & access control
LeakIQ uses a layered role-based access control model with two levels: account-level roles that govern the company (billing, users, connector setup) and workspace-level roles that govern day-to-day recovery operations. A user can belong to one or more workspaces and is assigned a workspace role independently in each, a single login carries all of a user's memberships, and switching workspace applies that workspace's role. Permission checks are enforced server-side on every request: recovery actions (execute, approve, reject and record-outcome) and all connector, user and billing changes are role-gated in the API layer, not only in the UI.
Account-level roles (company)
| Role | Capabilities |
|---|---|
| Account Owner | Company-level authority across all workspaces on the account: billing and subscriptions, company settings, user and workspace management, connector/integration setup, and governance oversight. |
| Integrations manager | A delegatable grant that lets a nominated user set up and manage connectors on the Owner's behalf, without conferring full Owner authority over billing or users. |
Workspace-level roles (per workspace)
| Role | Capabilities |
|---|---|
| Admin | Full operational control within a workspace: recovery cases, approval thresholds, member roles and audit-log export. Connector setup and billing are account-level (Owner/Integrations) and are not exposed to workspace Admins. |
| Operator | Can triage, progress, execute and close recovery cases within a workspace. Cannot manage connectors, users or billing. |
| Viewer | Read-only access to recovery cases, queues and reports. Cannot take actions or change settings. |
Business email enforcement: Registration is restricted to business email addresses. Personal email domains (Gmail, Outlook, iCloud, Yahoo, Hotmail and others) are rejected at account creation before any database write occurs. This check is enforced server-side and cannot be bypassed.
Login rate limiting and account lockout: After 5 consecutive failed login attempts for a given email address, the account is locked for 15 minutes. Lockout state is stored in the database against the user record, it persists across serverless cold starts and multiple Vercel instances. Attempt counters reset to zero on the next successful authentication. Failed attempts against unknown email addresses are silently dropped.
| Property | Detail |
|---|---|
| Lockout threshold | 5 consecutive failed login attempts for the same email address |
| Lockout duration | 15 minutes from the time the 5th failure is recorded |
| Lockout scope | Per email address, not per IP address |
| Persistence | DB-backed (User.lockedUntil), survives serverless restarts |
| Reset condition | Successful authentication clears the counter and removes any lockout |
| Admin unlock | Platform administrators can unlock accounts immediately from the platform-admin Users panel |
Session tokens: Sessions are managed by NextAuth v4 using a JWT strategy. The JWT is stored in a signed, encrypted HTTP-only cookie. There is no server-side session store, tokens are stateless and self-contained. Sessions expire on an activity-based cycle.
Recovery approval governance: High-value recoveries require sign-off before they can execute, segregation of duties is enforced by the platform, not left to process. Approval authority is threshold-based and configurable per workspace: recoveries at or above the workspace's approval threshold require management approval, and those at or above the higher senior threshold require senior-management sign-off. Below the threshold no approval is required. Thresholds default to £10,000 (management) and £50,000 (senior management) and are set by Admins under Settings → Approvals. The gate is enforced server-side, an over-threshold recovery cannot execute without a recorded approval, and every approval decision is written to the immutable audit lineage as a governance event.
Platform administrator actions: LeakIQ platform administrators have access to a set of privileged user management actions, each of which is written to the audit log.
| Admin action | What it does | Audit classification |
|---|---|---|
| Unlock account | Immediately clears a rate-limit lockout and resets the failed attempt counter | ADMIN_ACTION |
| Send password reset | Generates a signed HMAC recovery token (1-hour expiry) and delivers a password reset link to the user's registered email address | ADMIN_ACTION |
| Suspend workspace | Sets client status to SUSPENDED, workspace remains accessible but is flagged for review | ADMIN_ACTION |
| Reactivate workspace | Restores client status to ACTIVE | ADMIN_ACTION |
| Delete client | Permanently removes a client with no attached workspaces | ADMIN_ACTION |
Multi-factor authentication
LeakIQ supports TOTP-based multi-factor authentication (RFC 6238). MFA is compatible with any standards-compliant authenticator app including Google Authenticator, Microsoft Authenticator, Authy and 1Password.
| Property | Detail |
|---|---|
| Protocol | TOTP, RFC 6238 (Time-based One-Time Password) |
| Token length | 6 digits, 30-second window |
| Enrolment | QR code scan or manual secret entry in authenticator app |
| Backup codes | 8 single-use recovery codes generated at enrolment, stored hashed (scrypt) |
| Availability | Opt-in for any account; self-service enrolment. Enrolled accounts are challenged for a code at sign-in |
| Audit events | Enable and disable events written to the audit log |
Two-factor authentication is optional and off by default; a normal sign-in remains a single step for accounts that have not enrolled. MFA status is tracked per user, and enrolment and removal are written to the audit log.
Data handling
LeakIQ ingests read-only financial event data from connected systems and stores structured records for case analysis and workflow management. Data ingested is limited to what is necessary to identify and recover billing discrepancies.
What LeakIQ stores:
- Raw event records from connector syncs (invoice records, payment records, dispute records, as returned by the source system API)
- Recovery case metadata (amounts, statuses, SLA states, assigned operators)
- Approval records with timestamps and approver identity
- A full, append-only audit log of every action taken within the platform
- Encrypted connector credentials (API keys and OAuth tokens)
What LeakIQ does not store:
- Payment card data (no PCI scope, card processing is handled entirely by Stripe)
- Bank account details or sort codes
- User passwords in plaintext (passwords are hashed with scrypt, a memory-hard key-derivation function, before storage)
- Connector credentials in plaintext (all encrypted at rest, see Security & encryption)
workspaceId filter enforced at the ORM layer. It is architecturally impossible for one workspace's data to appear in another workspace's query. There is no shared data pool between tenants.| Data category | Where stored | Retention |
|---|---|---|
| Connector event records | Neon PostgreSQL (RawIntegrationEvent) | Retained for the lifetime of the active connection |
| Recovery cases & queue items | Neon PostgreSQL | Retained for workspace lifetime |
| Audit log | Neon PostgreSQL (AuditLog) | Retained indefinitely; append-only |
| Connector credentials | Neon PostgreSQL (IntegrationCredential, encrypted) | Deleted immediately on connection removal |
| Session tokens | Signed/encrypted HTTP-only cookie (client-side only) | Expiry-bounded; no server-side copy exists |
Data residency: The default database region is EU (Neon PostgreSQL, AWS eu-west-1, Ireland). Application compute runs on Vercel in the United States, and transactional email on Resend (US), under Standard Contractual Clauses; no customer data is stored on those layers, all persistent data lives in the EU database. See leakiq.io/legal/data-transfers for the full position. Alternative database regions are available on request for Enterprise customers.
Security & encryption
Connector credentials (API keys, OAuth tokens) are encrypted before being written to the database and decrypted in-memory only when a connector call is made. The plaintext credential is never stored and never logged.
| Property | Detail |
|---|---|
| Encryption algorithm | AES-256-GCM (authenticated encryption with associated data) |
| IV | 12-byte cryptographically random IV, generated per encryption operation |
| Authentication tag | 16-byte GCM auth tag verified on every decryption, tampered or corrupted ciphertext is rejected |
| Key derivation | SHA-256 hash of CONNECTOR_CREDENTIAL_SECRET environment variable |
| Storage format | base64(IV) · base64(authTag) · base64(ciphertext) stored as a single field |
| Transport encryption | TLS 1.2+ enforced by Vercel on all connections (inbound and outbound) |
Timing-safe secret comparison: Webhook secrets (used by the in-progress Zapier connector) are compared using Node.js crypto.timingSafeEqual, preventing timing-oracle attacks on secret verification.
Runtime access boundary enforcement: LeakIQ asserts the following access boundary properties on each request cycle:
| Boundary | State |
|---|---|
| Workspace isolation enforced | Yes, all queries scoped to workspaceId at ORM level |
| Runtime isolation enforced | Yes, no shared runtime state across workspaces |
| Cross-workspace data access | Blocked, enforced at both ORM and application layer |
| Replay execution | Disabled |
| Distributed cross-workspace coordination | Disabled |
Security event monitoring: Security-relevant events, permission denials, role and access changes, MFA enable/disable, and connector and billing changes, are recorded in the append-only, hash-chained audit trail described below, where they are queryable and exportable for review.
Audit trail
Every action taken within LeakIQ, recovery decisions, approvals, escalations, connector events, role changes, billing events, MFA changes, is written to an append-only audit log. Entries are never updated or deleted after creation.
The audit log implements a hash-chain integrity model. Each entry carries a reference to the previous entry, making retrospective tampering detectable. The full log is exportable by Admin users from the Audit & Evidence section at any time.
| Field | Description |
|---|---|
| event | Machine-readable event name (e.g. recovery.case.approved, queue.item_auto_assigned) |
| entityType | The type of entity the event relates to (e.g. RecoveryCase, Workspace) |
| entityId | The ID of the entity |
| userId | The user who performed the action (null for system-generated events) |
| metadata | JSON payload with event-specific context |
| createdAt | UTC timestamp, immutable after write |
In addition to the operational audit log, an immutable audit lineage layer records high-sensitivity events across the following typed categories:
| Lineage event type | What it covers |
|---|---|
| WORKFLOW_TRANSITION | Recovery workflow state changes |
| ESCALATION_EVENT | SLA breach and escalation triggers |
| INTERVENTION_EVENT | Manual operator interventions |
| BILLING_EVENT | Subscription, payment and invoice lifecycle |
| RBAC_CHANGE | Role assignments and permission changes |
| SSO_CHANGE | Identity provider configuration changes |
| MFA_EVENT | MFA enrolment, verification and removal |
| ROLL_OUT_APPROVAL | Governance approval decisions |
| ADMIN_ACTION | Privileged administrative actions |
GDPR & data privacy
LeakIQ processes personal data as a data processor on behalf of its customers (the data controller). Personal data processed is limited to what is contained within financial records (invoices, payments, dispute records) as returned by connected source systems.
| Topic | LeakIQ position |
|---|---|
| Data controller | LeakIQ's customer (the workspace owner) |
| Data processor | LeakIQ |
| Lawful basis | Contractual necessity / legitimate interests (revenue recovery operations) |
| Data subjects | Your customers whose billing records are being reconciled |
| Right to erasure | Supported, submit a deletion request to support@leakiq.io |
| Data portability | Audit log and case data exportable by Admin users at any time |
| Data Processing Agreement (DPA) | Available on request, contact support@leakiq.io |
| UK GDPR | Applicable, LeakIQ operates as a UK-based service |
Sub-processors: LeakIQ relies on the following sub-processors to deliver its service. Full sub-processor details, data locations and applicable data protection frameworks are included in the DPA.
| Sub-processor | Role | Data handled |
|---|---|---|
| Vercel | Application hosting & serverless runtime | Request metadata; no persistent customer data stored |
| Neon | Database (PostgreSQL) | All persistent workspace and customer data |
| Resend | Transactional email delivery | Recipient email address and notification content |
| Stripe | Billing & payment processing | Subscription and billing data only; no revenue recovery data |
Enterprise SSO
LeakIQ supports federated authentication via OpenID Connect (OIDC). SSO is enabled at the platform level, and sign-in is restricted to approved email domains. SSO governs authentication only; user accounts and their roles are provisioned and managed within LeakIQ, not derived from the identity provider.
| Provider | Protocol | Availability |
|---|---|---|
| Google Workspace | OAuth 2.0 / OIDC | Available |
| Microsoft Azure AD / Entra ID | OAuth 2.0 / OIDC | Available |
| SAML 2.0 (any compatible IdP) | SAML | Roadmap |
Roles are assigned within LeakIQ and are not derived from IdP group membership. All SSO configuration changes are classified as SSO_CHANGE events and written to the immutable audit lineage log.
InfoSec Q&A
The questions we receive most often from IT and security teams during vendor review.
Do you store our financial data?
We store the minimum data needed to detect and surface revenue gaps: metric snapshots, event records, and derived issues. We do not store raw payment card data. All data is associated with your workspace and deleted when the workspace is closed.
Can you write to our systems?
No. All connectors are read-only. LeakIQ does not send requests that create, update or delete records in any connected source system.
How are credentials protected?
Credentials are encrypted with AES-256-GCM using a secret key that is stored separately from the database. Credentials are never returned in API responses or written to logs. The encryption key can be rotated without a data migration.
Where is data stored?
In the EU, Neon PostgreSQL on AWS eu-west-1 (Ireland). Application compute runs on Vercel in the US under Standard Contractual Clauses; nothing is stored there. See leakiq.io/legal/data-transfers. Alternative database regions are available for Enterprise customers on request.
Do you offer a DPA?
Yes. Contact security@leakiq.io and we will provide a signed Data Processing Agreement within two business days.
Are you SOC 2 certified?
No. We do not hold a SOC 2 report and are not currently under audit; it is on our roadmap. Our infrastructure providers (Vercel, Neon, AWS) hold their own SOC 2 attestations, which cover their layer, not ours. Contact us for our current security posture documentation.
How do we revoke access?
Disconnect a connector from the Connected Systems page at any time, this immediately invalidates the credential and stops all API calls. Closing the workspace purges all data.
What happens if LeakIQ is compromised?
We follow a documented Incident Response Plan covering detection, triage, containment, eradication, recovery and notification. Affected customers are notified without undue delay, and in any event within 72 hours of confirming a personal data breach, by email, with the information they need to meet their own regulatory obligations.
Can we get a penetration test report?
We are commissioning an independent, CREST-accredited penetration test; the executive summary will be available under NDA on completion. Contact security@leakiq.io.
How do we conduct a security review before connecting?
Start with the Security posture section above and this Q&A. For deeper review, email security@leakiq.io, we can schedule a technical call with your InfoSec team and complete your security questionnaire.
Zapier webhook connector
https://api.leakiq.io. Requests to api.leakiq.io/<path> map directly to the corresponding API route, no additional prefix required.The Zapier connector will use an inbound webhook rather than an outbound API call. LeakIQ will generate a unique, per-workspace webhook URL, and Zapier will POST to it when a trigger fires in your account, so LeakIQ can receive events from any of Zapier's 7,000+ connected apps.
Endpoint:
POST https://api.leakiq.io/integrations/zapier/webhook?connectionId=<id>&secret=<plaintext>
Authentication:
- The
connectionIdis looked up and must exist as an active connection - The stored encrypted secret is decrypted at runtime and compared to the query parameter using
crypto.timingSafeEqual, preventing timing-oracle attacks - Invalid or missing credentials return
401 Unauthorized
Accepted payload (JSON body):
{
"eventType": "payment_failed", // optional, defaults to "zapier_event"
"externalId": "evt_abc123", // optional, used for deduplication
// any additional fields are stored as-is in the event payload
}Successful delivery creates an event record with status RECEIVED. Events are deduplicated on (connectionId, externalId, eventType), duplicate deliveries are safely ignored. The webhook URL can be regenerated at any time from the Connected Systems page, immediately invalidating the previous secret. Failed deliveries are automatically retried (see Operational automation).
Operational automation
LeakIQ runs a set of scheduled background processes that drive operational workflows. All jobs are authenticated using a server-to-server bearer token (CRON_SECRET) and run on Vercel's managed cron infrastructure.
| Process | Schedule | What it does |
|---|---|---|
| Issue auto-assignment | Every 15 minutes | Assigns unassigned open queue items to Operator/Admin members using workload-balanced round-robin (fewest open items first) |
| First-detection notification | Hourly | Fires once per workspace after the first connector sync that surfaces at least one revenue issue; sends a detection summary email to the workspace Admin. Idempotent, skips if already sent (Workspace.firstDetectionEmailSentAt is set) |
| Escalation notification | Daily at 08:00 | Emails workspace Admins when queue items are at-risk or breached SLA; marks associated workflows as escalated |
| Approval reminder | Daily at 09:00 | Sends reminder emails for pending approvals at 48-hour (amber) and 7-day (red) thresholds |
| Payment dunning | Daily at 09:00 | Emails workspace Admins at day 3 and day 7 of a payment failure; skips if payment has since succeeded |
| Trial expiry warning | Daily at 08:00 | Sends warning emails at 7 days and 3 days before trial expiry (24-hour final warning sent 12-36 hours before expiry) |
| Inactivity re-engagement | Daily at 09:00 UTC | Emails trial workspace Admins when no AuditLog activity has been recorded in the past 7 days. Idempotent within the deduplication window |
| NPS pulse | Daily at 10:00 UTC | Sends a single-question Net Promoter Score email to workspaces that are 21-28 days old (mid-trial for 30-day pilots). Responses are recorded at /api/nps. Fires once per workspace |
| Monthly reconciliation summary | 1st of month at 07:00 | Emails Growth and Enterprise workspace Admins a prior-month summary: issues detected, resolved, open and total exposure |
| Webhook retry | Every 10 minutes | Retries failed webhook deliveries with exponential backoff |
| Connector health alert | Hourly | Checks connector health; alerts Admins if a connector is degraded or unreachable |
Webhook retry & dead-letter queue: Failed webhook deliveries are automatically retried on the following backoff schedule:
| Attempt | Delay |
|---|---|
| First delivery | Immediate |
| Retry 1 | 5 minutes |
| Retry 2 | 30 minutes |
| Retry 3 (max) | 2 hours |
After maximum attempts are exhausted, the item is moved to a dead-letter queue for manual review by workspace Admins. All retry state transitions are recorded in the audit log with workspace ID, entity type and last error.
Have a security or technical review question?
We're happy to complete security questionnaires, provide a Data Processing Agreement, supply additional architecture detail, or join a technical review call before you connect your systems.