Security

Data is encrypted in transit (TLS) and at rest. Integration credentials are encrypted, masked in the UI, and never included in logs or AI prompts.

Accounts use password-based and OAuth authentication. [Where available: multi-factor authentication and step-up approval for high-risk actions.]

Role-based access with 12 default roles and custom roles. Separation of duties is enforced: creator ≠ reviewer ≠ approver ≠ payer. High-risk actions require step-up approval.

An append-only audit log records authentication, access changes, exports, period locking, deletions, and approval decisions. Ordinary users cannot alter audit records.

Each organization's data is logically isolated. One company's data is never mixed with another's. Demo organizations are fully separated from real organizations.

Data is backed up on a regular schedule with integrity verification and periodic restore testing.

We monitor for availability, anomalies, and security events. Authorization denials and unusual access are recorded as security incidents.

We follow a documented incident response process. Where an incident affects your data, we notify affected customers and any required authorities without undue delay.

The platform is hosted in the European Union under sovereign mode. [Specify hosting provider(s) and region(s).]

If you discover a security issue, please report it responsibly to security@leadersmind.com. We acknowledge reports promptly and work with reporters on coordinated disclosure.

Security inquiries: security@leadersmind.com.

We are working toward recognized independent certifications, including SOC 2 and ISO/IEC 27001. [Status: in progress.]