AI & Data Security at LeanOS

LeanOS is a continuous-improvement platform for manufacturing plants (5S audits, defect tracking, root-cause analysis, maintenance/TPM, safety, quality). Customers store operational data that can include trade secrets, so the platform is built on a defense-in-depth model: database-enforced tenant isolation, least-privilege access, a tamper-evident audit trail, and an AI layer designed so that using AI never requires trusting AI.

The five commitments this document substantiates:

1. AI is optional — a per-workspace switch, enforced server-side, that fails closed.
2. AI conversations are not retained — our logs store cryptographic hashes, never content.
3. No training on customer data — our AI provider processes requests under commercial API terms that exclude model training.
4. No cross-tenant exposure — AI context is scoped by row-level security in the database, verified by adversarial testing.
5. Humans decide — every AI output is a draft a person confirms before it becomes a record.

LeanOS is a multi-tenant SaaS. Isolation is enforced at the lowest layer that can enforce it — the database — rather than in application code alone:

• Row-level security (RLS) on every business table. Every query is filtered to the caller’s workspace by PostgreSQL policies. An application bug cannot read another tenant’s rows, because the database refuses to return them.
• Role-based access (owner / admin / member / read-only auditor), re-checked server-side on every write route — never trusted from the client.
• Private file storage. Photos and documents live in private buckets and are served only via short-lived signed URLs. An automated check fails our health dashboard if any bucket is ever made public.
• Gated exports. Every data export is role-gated (the auditor role cannot download tabular data), rate-limited per user and per organization, and written to the audit trail with actor, filters, IP, and user agent.

Verification  July 2026 adversarial conformance test: ~1,050 cross-tenant probes across 10 synthetic tenants — including org-id re-tagging, profile smuggling, RPC and storage attacks — with zero isolation failures. The harness is retained and re-runnable.

AI in LeanOS assists at the point of work: suggesting a defect from a photo, drafting a work order from a symptom, proposing countermeasures for a root cause, summarizing a day’s maintenance picture. Inference is performed by Anthropic’s Claude models over the commercial API. The data path for every AI request:

• The switch (fail-closed). Every AI route first checks the workspace’s AI setting. Off → the request is refused with a clear message. If the setting cannot be read (e.g. a transient database error), the request is refused, not allowed — an explicit design decision so a compliance opt-out is honored even mid-outage. Blocked attempts are logged for the customer’s admin.
• Hash-only logging. Our AI call log records the route, model, token counts, latency, and SHA-256 hashes of the prompt and response. The text of prompts and responses is not stored in LeanOS.
• Prompt-injection defense. User-authored free text is wrapped in delimiters and declared as data to the model via a centralized helper, so instructions planted in a defect note cannot steer the AI acting for another user.
• Provenance. Records the AI helped draft carry a machine-readable provenance field (model, prompt version, original input), so customers can always distinguish AI-assisted entries.

Verification  Ask us to flip the AI switch during your evaluation and observe every AI endpoint refuse. The hash-only log schema and the fail-closed gate are inspectable under NDA.

Every create, update, delete, and export in LeanOS writes an append-only audit entry. Each workspace’s entries form a SHA-256 hash chain — every entry’s hash covers its content plus the previous entry’s hash — so any after-the-fact modification breaks the chain visibly. Customers can verify their own chain from inside the product at any time; we monitor chain integrity for every tenant on our internal health dashboard.

This is the chain-of-custody property quality and compliance audits (IATF 16949, ISO 9001, GMP/FSSC) ask for — and it also means LeanOS itself cannot silently alter customer records.

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256, managed by our infrastructure providers). LeanOS engages a small number of subprocessors, published with purpose and region on our public subprocessors page:

Our infrastructure subprocessors hold industry certifications (AWS, Supabase, Vercel, Anthropic — SOC 2 Type II and/or ISO 27001). Regional deployment options are available under enterprise agreements where data-residency requirements apply.

• Backups: nightly encrypted backups of the database and file storage, stored separately from production, with restore procedures that are actually tested — plus a written disaster-recovery runbook (published in our Trust Center).
• Secure development: all changes ship through pull requests with CI gates, including secret scanning (gitleaks) on every push and a database-privilege guard that fails the build if a privileged function is ever exposed to unauthenticated roles.
• Continuous verification: an internal health dashboard runs 20 automated checks — tenant-isolation policies, storage privacy, audit-chain integrity per tenant, audit-log freshness, privileged-function hygiene — on demand and before onboarding new customers.
• Monitoring & disclosure: error monitoring (Sentry), a public status page, and a published vulnerability disclosure policy.

• GDPR & India DPDP: privacy policy with lawful basis, retention schedule, and AI-use disclosure; data subject rights supported by built-in DSR export/anonymization tooling. Deleted users are anonymized in historical exports.
• DPA: a GDPR/DPDP-aware Data Processing Agreement — processing roles, technical & organizational measures, subprocessor annex, and cross-border transfer mechanisms (SCCs) — available from the Trust Center.
• Security questionnaires: completed as part of enterprise procurement; a pre-filled vendor information sheet is available on request.
• Certifications: LeanOS relies today on the certified infrastructure listed in §05 and the verifiable controls in this paper; our own SOC 2 program is planned as enterprise adoption grows. We are transparent about this distinction.