Security & trust
Leneeto treats security, privacy, testing and recoverability as product concerns. This page describes the principles we use — without inventing certifications or assurances that do not yet exist.
Discuss a security requirementAuthentication, session handling and role permissions should be explicit, reviewable and enforced beyond the visual interface.
Multi-organisation systems require deliberate separation so one customer's data cannot be reached through another customer's context.
Keys, credentials and sensitive records belong in controlled server-side environments, not exposed client code or public repositories.
Inputs, APIs and operational actions should be validated, rate-limited where appropriate and designed to fail safely.
Critical workflows require repeatable tests and review evidence rather than confidence based only on a successful demonstration.
Backup, restore and operational recovery need to be considered before a product is described as production-ready.
External services and APIs should have clear permissions, failure behaviour, audit trails and ownership.
Leneeto will not claim certifications, penetration-test results or compliance evidence that has not actually been completed.
Before launch
01
Roles, data boundaries, APIs, secrets and critical trust assumptions are understood.
02
Authenticated and role-sensitive journeys are covered with repeatable evidence.
03
Backup and restore behaviour is tested rather than assumed.
04
Where risk warrants it, external specialists can review security, legal or compliance claims.