Security & data residency

Where your data lives

• Telemetry is processed and stored within the European Union, in line with the GDPR.
• Full-fidelity data never leaves your infrastructure. The agent’s local store — everything your systems emit, kept for a short window — runs co-located with the agent, on your hosts. Only the demanded subset is forwarded to LeanSignal.
• Tenants are isolated. Each tenant runs with its own application backend and telemetry storage; your telemetry is never commingled with another tenant’s.

Agent connectivity

• The agent dials out only: a single long-lived gRPC stream over TLS to port 443. LeanSignal never connects into your network, and no inbound firewall rules are required.
• Agents authenticate with a per-agent key, sent as stream metadata and as a bearer token on telemetry writes. One connection per key is enforced.
• In the app, agent keys are visible to admins only and masked until explicitly revealed. Inject them via environment variables or secret managers — never commit them (see Agent configuration).
• The agent is open-source software (Apache-2.0) — you can audit exactly what runs at your edge and what it sends.

Signing in and sessions

• Authentication runs through the LeanSignal control center: password sign-in, OAuth (Google/GitHub), or a tenant’s own OIDC single sign-on. Passwords require at least 12 characters and are checked against known breaches at registration; resets are self-service, enumeration-safe email links. Registration and password-reset forms are bot-protected.
• Sessions are HttpOnly cookies — control-center sessions expire after 6 hours of inactivity, and the tenant app adds CSRF double-submit protection. No tokens are kept in browser storage.
• Access inside a tenant is role-based — admin, editor, viewer — enforced by the API, not merely hidden in the UI. See User roles.

Email consent

Alert email is consent-gated: tenant members can opt out of alert emails or all email entirely (their choice always wins), and outside recipients receive nothing until they explicitly verify their address. See Channels for how eligibility appears in the app.

Demand bundles

Exported demand bundles are safe to share and to keep in version control: server-owned identifiers, provenance, and statistics are stripped, and notification channels are referenced by name only — no IDs, no webhook URLs, no secrets. See Work with demands.

Your data and leaving LeanSignal

Demand bundles export your dashboards and alert rules as portable JSON, and your stored telemetry remains queryable through the standard PromQL, LogQL, and TraceQL query APIs the app uses — up until you delete the tenant, which permanently removes it.

For help: open an issue on the agent repository for anything agent-side, or — as a tenant admin — open a support case in the app under Settings → Support.