Compliance and verification
Independent auditors test our security controls. You can download our SOC 2 Type 1 report once you accept our confidentiality terms.
LeanSuite Trust Center: Secure your operations, build with confidence
LeanSuite protects your operational data: it has a SOC 2 Type 1 report, is hosted on secure cloud infrastructure, encrypted in transit and at rest, with single sign-on, multi-factor authentication and role-based access.
SOC 2 Type 1 Compliant
Secure cloud hosting
Encrypted in transit and at rest
Single sign-on (SSO)
OUR COMMITMENT
Layered security for your data
Our security program covers our infrastructure, development practices and company policies, and is checked by independent auditors.
Infrastructure and network security
LeanSuite runs on secure cloud infrastructure with redundancy, disaster recovery, network monitoring, firewalls and DDoS mitigation.
Data encryption
All data is encrypted in transit with TLS 1.2+ and at rest with AES-256, including production databases, file stores and backups.
Access control
Custom roles per module limit each user to their department, pillar or team. Single sign-on uses SAML 2.0 or OAuth with Microsoft Entra ID and Okta, and multi-factor authentication is available.
AT A GLANCE
Security at a glance
The specific commitments in our service agreement, for your security review.
Compliance
- SOC 2
- SOC 2 Type 1 report, downloadable from this Trust Center once you accept our confidentiality terms
- Privacy
- GDPR and PIPEDA; a data processing agreement with standard contractual clauses for EU and UK data
- Security reviews
- Your security questionnaire and our penetration test summary, once a year on request
Infrastructure
- Hosting
- Secure cloud data centers with redundancy, firewalls and DDoS mitigation
- Encryption
- TLS 1.2+ in transit and AES-256 at rest, including databases, file stores and backups
- Backups
- Daily, with a disaster recovery plan reviewed every year
Access
- Single sign-on
- SAML 2.0 or OAuth with Microsoft Entra ID and Okta; multi-factor authentication available
- Permissions
- Custom roles per module, limited to a department, pillar or a manager's own team
- Shop floor sign-in
- Employee-ID sign-in for operators who have no company email
Availability and support
- Uptime
- 99.5% monthly uptime commitment
- Maintenance
- Between 2 and 5 a.m. Eastern, with 24 hours' notice
- Support
- Help desk 24 hours a day, 5 days a week; critical issues answered within 24 hours
Incidents and your data
- Incident notice
- We notify you of a security incident affecting your data within 72 hours
- Ownership
- You own your data and can export any module to Excel at any time
- Leaving
- Export everything for 30 days after the contract ends; after that we may delete it
How onboarding and support work from kick-off to go-live: see implementation
SHARED RESPONSIBILITY
Securing your operations, together
Security is a shared responsibility. We provide a secure platform, and you control how it's used within your organization.
LeanSuite's responsibility
Maintaining the security and availability of the cloud infrastructure.
Securing the application against vulnerabilities.
Protecting the confidentiality and integrity of your data within our platform.
Your responsibility
Managing your users and their access permissions.
Enforcing strong password policies or using SSO.
Securing the devices you use to access the LeanSuite platform.
OPERATIONAL RESILIENCE
Built to keep your operations running
Our policies and procedures keep the service available and secure, backed by a 99.5% monthly uptime commitment in our service agreement.
Personnel security
Every employee passes a background check, completes security training each year and signs a confidentiality agreement.
Business continuity
Automated backups, multi-zone infrastructure and a disaster recovery plan restore the service promptly after an outage.
Incident response
A formal plan covers detection, containment, investigation, notification and a post-mortem.
FOR YOUR SECURITY REVIEW
Security documents you can request
Download our SOC 2 report here, or email support@theleansuite.com and our team will send the rest of what your review needs.
SOC 2 report
Our SOC 2 Type 1 report. Accept our confidentiality terms and it downloads right away.
Download itPenetration test summary
A summary of our latest penetration test, once a year on request.
Request itSecurity questionnaire
Send us your questionnaire and we complete it, once a year on request.
Request itData processing agreement
A DPA with standard contractual clauses for EU and UK personal data.
Request itSub-processor list
Our critical third-party sub-processors, including hosting and AI providers.
Request itFound a vulnerability?
Send a detailed report to support@theleansuite.com. We run a responsible disclosure program and address validated issues promptly.
Scope, rules and what to include
RESPONSIBLE DISCLOSURE
Report a vulnerability
If you believe you have found a security issue in LeanSuite, email support@theleansuite.com. It is our only security mailbox, and our team reads it. We acknowledge every report and credit the ones that lead to a fix.
What is in scope
- theleansuite.com and its subdomains (www, help)
- theleansuite.app, the customer application
- starter.theleansuite.com, the free Starter plan
- The LeanSuite iOS and Android apps
Third-party services we use (for example our help center, scheduling and chat vendors) have their own programs; report issues in them to that vendor.
What to include
- The URL, endpoint or app screen affected, and the account type you used
- Steps to reproduce, with a request and response or a short recording
- What an attacker could do with it, in your own assessment
- How to reach you for questions and for credit
Testing rules
- Test only against accounts you own. Do not read, change or delete other customers' data.
- No denial of service, spam, social engineering of our staff or customers, or physical attempts.
- Give us a reasonable time to fix the issue before you publish anything about it.
- Automated scanning is fine at low volume; stop if we ask.
What we do in return
- We acknowledge your report and keep you informed while we fix the issue.
- Valid reports are credited by name or handle once the fix is live, if you want the credit.
- We do not run a paid bounty program and do not pay in advance of disclosure.
- Researchers who follow these rules will not face legal action from us for their testing.
FAQs
Your security questions, answered
A Type 1 report attests that security controls are properly designed at a single point in time; a Type 2 report attests that they work over a period of time. LeanSuite is Type 1 compliant and on track for its Type 2 audit.
Download it at theleansuite.com/security/soc-2-report. Enter your work email and accept our confidentiality terms, and your copy downloads right away.
If you believe you have found a vulnerability, send a detailed report to support@theleansuite.com, our only security mailbox. We acknowledge every report, fix validated issues promptly and credit the researcher. We do not run a paid bounty program. The scope, what to include and our testing rules are in the Report a vulnerability section above and at theleansuite.com/.well-known/security.txt.
Yes. Customers can get a list of our critical third-party sub-processors, including our hosting and AI providers, on request.
Our service agreement commits to 99.5% uptime each month. We do not offer service credits. Planned maintenance happens between 2 and 5 a.m. Eastern, with 24 hours' notice.
Yes. Our data processing agreement includes standard contractual clauses for personal data from the EU and UK.
Yes. Once a year on request we complete your security questionnaire and share a summary of our latest penetration test. Email support@theleansuite.com to start.
Yes. Operators can sign in with their employee ID, while office staff use single sign-on through SAML 2.0 or OAuth with Microsoft Entra ID and Okta. Role-based access control limits each person to the data they are allowed to see.
Yes. Each customer's data sits in its own database, and role-based access control limits each user to what they are allowed to see.
Yes. AI features can be turned off for your company if your policies require it.
No. Your data isn't shared with AI providers to train their models, and each facility's data is kept separate.
Your data is stored in secure cloud data centers. You can choose to have it hosted in a specific region (for example the United States or Europe) to meet data residency requirements.
We back up your data every day. Our infrastructure spans multiple availability zones, and a disaster recovery plan, reviewed every year, restores service promptly after a major outage.
Yes. A formal incident response plan sets out what our team does in a security incident, from detection and containment to notification and a post-mortem. If an incident affects your data, we notify you within 72 hours.
Every employee completes security awareness training when hired and every year after. Engineers also get training in secure coding.
You always own your data and can export any module to Excel at any time. After your contract ends, you can ask in writing within 30 days for your data in a commonly used format. After that we may delete it.
Ready to digitize with confidence?
Questions about security, or want to review our SOC 2 report? Get in touch with our team.