LeapCrew AIHome
[ SECURITY POSTURE ]

Security by design.

Multi-tenant isolation, AES-256-GCM encryption at rest, HMAC-SHA256 signed webhooks, and hashed API keys. Security is an engineering constraint at LeapCrew AI — not an afterthought.

AES-256-GCM AT RESTTLS 1.2+ IN TRANSITHMAC-SHA256 WEBHOOKSBCRYPT API KEYS
[ SECURITY MEASURES ]

How we protect your data.

AT REST + IN TRANSIT

Data Encryption

  • AES-256-GCM encryption for all secrets stored at rest (Meta access tokens, webhook signing secrets)
  • TLS 1.2+ enforced on all connections — no unencrypted traffic accepted
  • Encryption keys managed via environment-separated configuration
  • No plaintext secrets ever written to application logs
ZERO CROSS-TENANT ACCESS

Multi-Tenant Isolation

  • Every database query is scoped by organizationId — no query can access another tenant's data
  • API middleware validates organization membership on every authenticated request
  • Chatbot nodes, contacts, templates, campaigns — all row-level isolated by tenant
  • No shared mutable state between workspace instances
HASHED KEYS + SCOPED PERMISSIONS

API Authentication

  • API keys stored as bcrypt hashes — the raw key is never stored after issuance
  • Scoped permission model: read-only vs read-write vs admin keys
  • Sandbox (wf_test_) and live key separation for pre-production safety
  • Keys can be rotated or revoked instantly via the dashboard or API
HMAC-SHA256 SIGNATURES

Webhook Signing

  • All outbound webhook deliveries are signed with HMAC-SHA256
  • Signature delivered in the x-leapcrew-signature header for verification
  • Replay attack protection via timestamp validation window
  • Exponential backoff retry with delivery logging per endpoint
ENCRYPTED AT REST

Secret Management

  • Meta access tokens encrypted at rest with AES-256-GCM before database write
  • Webhook secrets similarly encrypted — never exposed in API responses
  • Decryption occurs only in-memory, in the server runtime context
  • Environment variables for encryption keys are never committed to version control
STRUCTURED + SCOPED

Audit Logging

  • Every significant platform action is written to SystemLog with organizationId scope
  • Structured JSON log format — queryable, parseable, and exportable
  • Logs include actor, action, resource type, resource ID, and timestamp
  • No cross-tenant log visibility — each organization sees only its own audit trail
[ VULNERABILITY DISCLOSURE ]

Responsible disclosure.

Found a security vulnerability? We take security reports seriously. Please disclose responsibly — we commit to working with you, not against you.

security@leapcrew.in
01
Acknowledge within 24h

We will confirm receipt of your report and assign an internal tracking reference within 24 hours of receiving your email.

02
Investigate within 72h

Our engineering team will reproduce and assess the severity of the reported issue within 72 hours, and communicate initial findings to you.

03
Fix critical issues within 7 days

Critical severity vulnerabilities (CVSS 9.0+) will be patched and deployed within 7 calendar days. We will notify you when the fix is live.

[ INFRASTRUCTURE ]

Built on a secure foundation.

PostgreSQL with encrypted storage

Primary database with AES-256 encryption at the field level for sensitive columns. Automated backups with encrypted storage.

HTTPS everywhere

TLS 1.2+ enforced on all endpoints. HTTPS Strict Transport Security (HSTS) headers set on all responses. No HTTP fallback.

Environment-separated secrets

Production, staging, and sandbox environments use fully independent credentials. No shared secrets across environments.

No debug endpoints in production

All development tooling, introspection endpoints, and debug middleware are disabled in the production build. No verbose error leakage.