Security

At a glance

How a question flows (the whole path)

When someone on your team asks Leap Past a question:

1. It travels encrypted (TLS, HSTS-pinned) from their device to our servers. They must be signed in, and requests are rate-limited with a per-company daily ceiling.
2. The question is converted for search locally on our server (self-hosted embedding model). If a photo is attached, the text in it is read by local OCR on the same server. Neither ever goes to an outside AI service.
3. Matching fixes and manuals are retrieved only from your company's records in a private database that is not reachable from the internet (TLS-required connection).
4. The answer is generated by our AI provider — currently Groq, a U.S.-based inference service. Your question and the retrieved snippets are sent to Groq to produce the reply; under Groq's API terms they are not used to train any model, and inference stays in US regions. (Search and reading any attached photo already happened locally in step 2.)
5. The answer streams back over the same encrypted channel. Question text is not written to server logs.

AI privacy is enforced by code, not policy

The server refuses to start unless its AI provider is on a small, vetted allowlist — a self-hosted open-source model, AWS Bedrock (in-account), Anthropic, or Groq — so it can never be pointed at an arbitrary endpoint. We currently use Groq (US). Embeddings and OCR always run on our own servers regardless of the answer provider. Your questions and documents are never used to train any model — ours or anyone else's.

Your data is isolated from every other company

Every record is tagged with your company and is invisible to any other company on the platform. Cross-company access requests return HTTP 404 and cross-company tokens are rejected on every request — including uploaded photos, which can't be fetched by guessing filenames. On the Proprietary tier, your company can run on its own isolated database — or its own AWS account entirely.

Encryption & passwords

All traffic is encrypted in transit with TLS 1.2+ — from the browser or app to our servers, and from the application to the database (TLS required). Data is stored on AWS managed services with encryption at rest. Passwords are never stored in plain text — only as bcrypt hashes — so no one, including us, can read them.

Accounts, access & abuse protection

Access is role-based (worker, technician, trainer, team lead, admin) and scoped to your company; people join only by an admin's email invite — there is no open signup. Repeated failed logins lock the account for a cooldown window, sessions can be revoked, and significant actions are written to an audit log kept inside your tenant. Public endpoints are rate-limited; uploads are restricted by type and size; AI usage has a per-company daily cap so no account can abuse the service.

Backups & availability

The database runs on Amazon RDS with automated daily backups and point-in-time recovery, so your knowledge survives hardware failure and mistakes. Services restart automatically, and TLS certificates renew automatically.

Subprocessors (the complete list)

Amazon Web Services — hosting, database, and AI inference (US regions). Resend — transactional email delivery (invites, password resets); it sees recipient email addresses only, never your knowledge base. Cloudflare — DNS and inbound email routing. That's the entire list; no analytics trackers or ad tech run inside the product.

Where we are honest about maturity

We're an early-stage company: we run internal security reviews of tenant isolation and common web risks before shipping changes, but we do not yet hold formal certifications such as SOC 2. We'll gladly complete your security questionnaire, walk your team through the architecture live, and fix anything you find — email hello@leappast.com.

Reporting a vulnerability

Found a potential issue? Please tell us at hello@leappast.com — we take reports seriously, will respond quickly, and will credit you if you'd like.