Skip to main content
SECURITY & TRUST · THE PROOF

Trust is not requested. It is proven.

Every fact on this page is stated carefully: a certification that exists, an examination in progress, and infrastructure by what actually runs in each product — not by what is pleasant to say. Next to every fact — its status and its source.

ISO/IEC 27001:2022SOC 2 · in progressme-west1 · Tel AvivDPA on request
CERTIFICATIONS · THE SEAL

What is certified. And what is not, yet.

Two things are examined by an external body. One ended in a certificate; the other is underway, and that is exactly what we will say about it — no more.

Verified

ISO/IEC 27001:2022

ISO/IEC 27001:2022 · Certificate 1126333 · IQNet & IQSR

The certification applies to the whole company — LeonAI LTD — as one organization, not to a single product. Issued by the Standards Institution of Israel (SII–QCD), valid until 26/10/2028. The certificate itself — here:

The certificate (SII)IQNet certificate (PDF)

In progress

SOC 2

SOC 2 Type II examination underway with Ernst & Young (Security — Common Criteria), commenced August 2026; report expected Q1 2027.

The examination is underway; the official report has not yet been received, so this is all we will say about it — no more. The bridge letter below documents the examination status and the controls in force in the interim.

SOC 2 Type II bridge letter (PDF)

THE REGISTER

Fact, status, source. Row by row.

This is not a marketing page — it is a register. Every row says what is true today, what standing the claim has, and where it can be checked.

The security facts register: the fact, its status and its source
The factStatusThe source
MCP for Priority · LeonAI Priority — The Priority products’ data stays in IsraelVerifiedGCP me-west1 · Tel Aviv — the two products’ own infrastructure
Israel is recognized by the European Union as a country with an adequate level of protection (adequacy)VerifiedThe EU adequacy decision
The me-west1 infrastructure egresses from fixed IP addresses you can add to your allowlistVerified34.165.219.216 · 34.165.236.22 · 34.165.106.6
SignFlow · Links · Secrets — Run on Cloudflare’s global edge network — routed by geographic proximity, without pinning the data to a specific countryVerifiedThe three products’ own infrastructure
Operational logs are kept for 30 days; daily backups are encrypted, with PITR for restoring to an exact point in timePolicyLeonAI’s operating procedures
The incident-response process operates under Israel’s Privacy Protection Law, including Amendment 13, and under GDPRPolicyLeonAI’s incident-response procedures
A data processing agreement (DPA) is available on requestPolicyWrite to us — details at the bottom of the page
Five sub-processors process the products’ data on our behalf — all of them listed here, on this page (the website’s own providers are listed in the privacy policy)VerifiedThe sub-processor register, below
THE CONTROLS

Not general promises. Each product’s own controls.

These lists are exactly the lists each product’s own page renders — same source, same words — so this page can never say something a product page does not.

MCP for Priority

  • Google Cloud Run (me-west1, Israel).
  • TLS 1.2+ on every hop — client, database, cache and ERP.
  • OAuth 2.1 with mandatory PKCE S256; 2FA on every plan; SAML 2.0 / OIDC single sign-on (SSO) on the Enterprise plan.
  • AES-256 on managed storage; ERP credentials additionally encrypted with Fernet.
  • Tenant credentials are stored encrypted with PBKDF2 at 480,000 iterations.
  • Per-tenant IP allowlist.
  • Every query, cache key and storage object namespaced by tenant.
  • Credentials and identifying details are masked in every log handler — passwords, API keys and tokens are never logged.
  • An audit log of every tool call.
  • Access logs are retained for 24 months, satisfying the Israeli Privacy Protection Regulations' access-logging requirement.
  • Writes are off by default, and each operation is approved once with a signed token valid for 90 seconds.
  • No ERP deletes exist.
  • ISO 27001 certified — the certification covers the whole company, not a single product.
  • SOC 2 Type II in progress.
To the product page

LeonAI Priority

  • All processing and storage for the Service run in Google Cloud region me-west1 (Tel Aviv, Israel).
  • Controlled egress: Cloud NAT with a fixed set of outbound IPs (34.165.219.216, 34.165.236.22, 34.165.106.6) that you can allowlist on your ERP firewall, with full outbound audit.
  • In transit: TLS 1.2+ at the edge; TLS 1.3 enforced edge-to-origin.
  • AES-256 with Google-managed keys across Cloud SQL, Memorystore, Secret Manager, and Cloud Storage backups.
  • Your Priority ERP credentials live in your own Make.com connection vault. LeonAI does not hold that vault.
  • Auth headers and bodies are scrubbed from the logs.
To the product page

SignFlow

  • SignFlow runs on Cloudflare's global edge network
  • Files sit behind an authenticated, fail-closed proxy — no public storage bucket and no pre-signed links.
  • A fail-closed PKCS#7 seal: a document does not complete without a valid seal.
  • An RFC-3161 timestamp from DigiCert on every completed document.
  • A SHA-256 audit chain with anchoring outside the system and a verification endpoint.
  • Documents retained for seven years by default, with deletion refused within the period.
  • An Israeli tax-compliance mode.
  • Google/Microsoft sign-in, TOTP two-factor authentication and SSO with SAML/OIDC.
To the product page

Links

  • Runs on Cloudflare's edge network.
  • Every link is scanned against Google Safe Browsing on creation, update and import, and rescanned every ten minutes — with automatic suspension and a warning page for the visitor.
  • Strict CSP and HSTS policies.
  • TOTP two-factor authentication and organizational sign-in with Google or Microsoft.
  • Email address verification before a link can be created.
  • API keys are stored as a hash and shown only once, with eight scopes to limit permission.
  • GDPR and CCPA/CPRA compliant out of the box — consent, export, and deletion built in.
To the product page

Secrets

  • Data is stored on Cloudflare's global edge network using D1 (SQLite), R2 (object storage), and KV (key-value storage). All data is encrypted at rest.
  • The server never stores the encryption key.
  • Encryption happens in the browser with AES-256-GCM via Web Crypto.
  • The secret is deleted from storage before the response is sent to the recipient.
  • Three wrong password attempts destroy the secret.
  • Expiration — between five minutes and thirty days — is enforced at the storage layer.
  • IP addresses are anonymized after 30 days, and audit logs are deleted after 90 days.
  • A CSP policy with a nonce regenerated for every request.
To the product page
THE CUSTODY

Who touches the data, and what you are promised.

The companies that process data on our behalf — and the three commitments we take on ourselves.

Sub-processor register

  • Google Cloud — Israel (me-west1)
  • Cloudflare
  • Make — EU (connection vault)
  • SUMIT — Israel (billing/payments)
  • Resend (email)
Data processing agreement

A DPA (data processing agreement) is available on request — write to us at the contact details at the end of the page.

Security incident response

The incident-response process operates under Israel’s Privacy Protection Law, including Amendment 13, and under GDPR.

Log retention and backups

Operational logs are kept for 30 days. The daily backups are encrypted, with PITR (Point-in-Time Recovery) for restoring to an exact point in time.

Smart moves — it’s in our nature

Found a security issue?

We would be glad if you reported it to us directly — before someone else exploits it. Write to us and we will get back to you fast.

care@leonai.ioCheck your fit