Trust
Security & compliance pack
Everything a vendor-security or procurement team needs to evaluate LeakIQ. Most of it is published openly below. The rest we provide on request, under NDA, as part of your review. We respond within one business day at security@leakiq.io.
LeakIQ does not yet hold a SOC 2 report or ISO 27001 certificate; both are on our roadmap, and a CREST-accredited penetration test is in vendor selection, with a CREST-accredited firm identified and the test not yet booked. We are happy to walk a reviewer through our current posture honestly. See the Trust Centre for the full picture.
Published openly
Information Security Policy
The umbrella policy governing how we protect data and systems.
Incident Response Plan
How we detect, contain, recover from and notify on incidents.
Business Continuity & DR Plan
Recovery objectives (RTO/RPO), backups and restore testing.
Vulnerability Disclosure Policy
How to report a security issue, and our safe-harbour commitment.
Technical documentation
Architecture, connector auth, encryption, RBAC, MFA and audit.
Data Processing Agreement
Our UK GDPR Article 28 processor terms.
Sub-processors
The third parties we use, what they handle, and change notice.
International Data Transfers
Where data is stored and processed, and the transfer safeguards.
Data Retention & Deletion Policy
How long each data category is kept, and how deletion works.
Standing right of export
MSA clauses 12.5 and 12.6, and the self-service export in Settings. Take a complete copy of everything we hold for your workspace at any time, without asking us. There is no escrow arrangement and we do not claim one.
On request, under NDA
Security questionnaire
We complete your questionnaire (CAIQ, SIG Lite or your own template) as part of the review.
Penetration test summary
An executive summary and attestation letter, available under NDA once the CREST-accredited test completes.
Business continuity / DR position
Our recovery objectives and backup arrangement, and what restore testing has actually shown. An independent restore test was carried out on 7 October 2026: a point-in-time copy recovered in about two minutes, with the audit hash chain recomputed end to end across 428,872 records. The measured result is in the continuity plan.
Data-flow diagram
How data moves through the platform, for your data-mapping.
Read-only scope detail
The exact read-only permissions requested per connected system.
Request the pack
Tell us which items you need and whether an NDA is required first. We will turn most requests around within one business day.