Yes, LeanOS uses AI. No, your data does not leak.
Last updated: 14 July 2026
Your plant data — defect photos, downtime causes, savings numbers — can contain trade secrets. So we built the AI layer on a simple principle: you should not have to trust us on it. Every guarantee below is enforced in code, logged, and verifiable — not a policy promise.
Six guarantees, enforced in code
AI is a switch you control — and it fails closed
Every AI feature in LeanOS runs behind a per-workspace setting. Turn it off and every AI endpoint refuses with a 403 — and if our system ever cannot verify your preference (for example during a database blip), the AI call is refused rather than allowed. Your opt-out is honored even when things break.
How to verify: Enforced server-side on every AI route (orgs.ai_features_enabled, fail-closed). Blocked attempts are logged so your admin can see who tried what.
We never store AI conversations
Our AI call log records SHA-256 hashes of each prompt and response — plus token counts and latency for billing transparency — never the text itself. A breach of our database cannot leak an AI conversation, because the conversation is not in it.
How to verify: ai_call_log schema: prompt_sha256 / response_sha256 — hash columns, no content columns.
Our AI provider does not train on your data
LeanOS calls Anthropic's Claude API under commercial terms: customer data sent to the API is not used to train models. One AI subprocessor, publicly listed, with a GDPR-ready DPA including Standard Contractual Clauses.
How to verify: Listed with terms on our public subprocessors page; Anthropic is SOC 2 Type II certified.
AI never sees another customer's data
Every AI request is scoped to your workspace by row-level security enforced in the database itself — the same isolation that protects all your data. Context for a suggestion is drawn only from your own records.
How to verify: Independently exercised in July 2026 by an adversarial multi-tenant test: ~1,050 cross-tenant probes across 10 synthetic tenants, zero isolation failures.
AI suggests. Your people decide.
Every AI output in LeanOS — a suggested defect, a drafted work order, a proposed countermeasure — is a draft a human confirms or edits before it becomes a record. No AI output writes to your system of record on its own.
How to verify: Human-in-the-loop by design across all modules; AI-drafted records carry provenance (ai_meta) so you can always tell what the AI proposed.
Injection-hardened prompts
Text your operators type (a defect note, a kaizen description) is wrapped as untrusted data before it reaches the model, with instructions to treat it as data — so a malicious or accidental 'ignore previous instructions' in a free-text field does not steer the AI.
How to verify: Centralized wrapUntrusted() defense applied across AI routes after our 2026 security audits.
What an AI request actually contains
- • The specific record being worked on (e.g. one defect photo + its note)
- • Feature context from your own workspace (e.g. your zone names)
- • Nothing else
- • Other customers’ data (impossible by database-level isolation)
- • Credentials, tokens, or user directories
- • Your full database or bulk exports
And on the way back: the AI’s reply is shown to your user as a draft, our log stores only a hash of it, and nothing is written to your records until a human confirms. The whitepaper documents the exact fields per feature.
Questions your security team will ask
Is our data used to train AI models?
No. LeanOS uses Anthropic's Claude via its commercial API, and under those terms customer data sent to the API is not used to train models. LeanOS itself trains no models on customer data.
Can we use LeanOS with AI completely disabled?
Yes. AI is a per-workspace switch. Many customers start with AI off, complete their internal security review, and enable it later — the core platform (audits, defects, maintenance, quality, safety) is fully functional without AI.
What exactly is sent to the AI provider when a feature runs?
Only the minimum fields the specific feature needs — e.g. the photo and note for a defect suggestion, or the problem statement for a countermeasure draft. Never credentials, never user directories, never another tenant's records. The whitepaper lists the data sent per feature.
Where is our data stored?
The primary database and file storage run on Supabase (AWS). AI inference requests are processed by Anthropic and, per its commercial terms, are not used for training. Regional deployment options for enterprise agreements are available — talk to us.
How would we verify any of this?
Three ways: (1) flip the AI switch off and watch every AI endpoint refuse; (2) request our security questionnaire responses and DPA; (3) inspect the tamper-evident audit trail — every record in LeanOS is SHA-256 hash-chained per workspace, so even we cannot silently alter your data after the fact.
Do you sign DPAs and complete security questionnaires?
Yes — our GDPR / DPDP-aware DPA (with subprocessor annex and cross-border transfer mechanisms) is available from the Trust Center, and we complete customer security questionnaires as part of enterprise procurement.
Running a security review?
We’ll walk your security team through the architecture live, complete your questionnaire, and sign a DPA. Many enterprise customers pilot LeanOS with AI disabled and switch it on after their review — the platform is fully functional either way.