Data Security and Compliance
Last updated July 10, 2026 · Version 1.0
Effective date: July 10, 2026
This page describes the technical and organizational measures LeonAI LTD ("LeonAI," "we," "us") uses to protect the LeonAI Links service (the "Service") and the data processed through it. It is informational: contractual commitments are made exclusively in the Terms of Service, the Data Processing Agreement (DPA), and, for Enterprise customers, the SLA. Security questionnaires and documentation requests: care@leonai.io.
1. Security Philosophy and Shared Responsibility
Security for a URL shortener has two dimensions: protecting customer and end-user data, and protecting the public from abusive links carried on our domain. We invest in both.
Responsibility is shared:
- LeonAI secures the platform — infrastructure, application code, encryption, monitoring, and link-safety systems.
- Customers secure their side — account credentials and MFA, API key handling and rotation, DNS configuration of custom domains, webhook endpoint security, and the lawful use of analytics data they receive as data controllers.
2. Infrastructure Security
- Hosting: Cloudflare's global network. Application workloads run as isolated Cloudflare Workers executed in the data centre nearest the visitor; data resides in Cloudflare D1 (SQLite), Workers KV, and R2 object storage, with background work dispatched through Cloudflare Queues. The primary database region is Cloudflare's Eastern Europe (EEUR).
- Network: Service-to-service traffic stays inside Cloudflare's network via native bindings rather than public endpoints; Cloudflare's CDN serves the edge; Cloudflare DDoS protection and WAF filter the redirect path, with managed rulesets and rate limiting enabled on the zone.
- Physical security: We operate no physical servers. Physical and environmental controls are inherited from Cloudflare's data centres, which are certified against ISO 27001, ISO 27701, SOC 2 Type II, and PCI DSS.
- Secrets: All credentials, signing keys, and API secrets are stored as Cloudflare Workers secrets, encrypted at rest by Cloudflare and never readable back through the API or dashboard; none are committed to source code or container images.
3. Encryption
- In transit: TLS 1.2 or higher is enforced on every endpoint, including all redirects; HTTP requests are upgraded, and HSTS is set on every LeonAI-operated domain, including the dashboard and the shared short-link domain.
- At rest: AES-256 encryption for the D1 database, Workers KV, R2 object storage, and backups (Cloudflare-managed keys).
- Credentials: Customer passwords are hashed with a modern adaptive algorithm (bcrypt/argon2). API keys are stored only as SHA-256 hashes with scoped permissions; the plaintext key is shown once at creation and cannot be retrieved afterwards.
- Webhooks: Every webhook delivery is signed with HMAC SHA-256 (
X-Webhook-Signature) so receivers can authenticate payloads.
4. Application Security
- Secure SDLC: TypeScript strict mode across the codebase; mandatory code review; CI gates for linting, type-checking, and tests before deployment.
- Injection defenses: All database access goes through Prisma with parameterized queries; no dynamic SQL.
- Browser defenses: Content Security Policy headers, SameSite cookies plus CSRF tokens on state-changing requests, and output encoding against XSS.
- Rate limiting: Tier-based rate limits on every endpoint, enforced in Redis, with standard
X-RateLimit-*headers and 429 responses. - Dependency and code scanning: Dependabot alerts and automated updates, Trivy container scanning, CodeQL static analysis, and npm audit in CI.
5. Access Control
- Internal access: Least-privilege roles on the Cloudflare account and scoped API tokens; production access restricted to named engineers with SSO and mandatory MFA; access reviewed quarterly and revoked on role change or departure.
- Customer-side controls: Role-based access control for teams, scoped API keys (
links:read,links:write,analytics:read), and short-lived JWT sessions. - Audit logging: Data exports, deletions, permission changes, and administrative actions are recorded in immutable audit logs.
6. Link-Safety Systems
Because abusive links endanger the public, link safety is part of our security program:
- Destination scanning: Every Destination URL is checked at creation and rescanned periodically against Google Safe Browsing and equivalent reputation services, supplemented by our own heuristic and machine-learning classifiers (redirect-chain analysis, domain-age signals, click-pattern anomaly detection).
- Interstitial warnings: Links suspected but not confirmed as harmful resolve through a warning page before the End User proceeds.
- Rapid takedown: Confirmed phishing and malware links are deactivated (HTTP 410) with a target response of 24 hours from report; see the Acceptable Use Policy for the full enforcement ladder and the abuse-reporting address (care@leonai.io, subject "Abuse Report").
7. Monitoring and Incident Response
- Observability: Cloudflare Workers Logs and Analytics for infrastructure; Sentry for application errors, with data scrubbing enabled so error contexts avoid capturing personal data.
- Alerting and on-call: Automated alerts on availability, latency, and error-rate thresholds route to an on-call engineer.
- Incident process: Documented severity levels (P1–P4), a defined incident commander role, post-incident reviews with corrective actions, and public status reporting for significant incidents.
- Breach notification: If a personal data breach occurs, we notify affected customers without undue delay, and within 72 hours of becoming aware, consistent with GDPR Articles 33–34 and the DPA, including the nature of the breach, likely consequences, and measures taken.
8. Business Continuity and Disaster Recovery
- Backups: Automated daily encrypted backups of the primary database with 35-day retention and point-in-time recovery.
- High availability: Workers run in every Cloudflare data centre, so there is no single region to fail, and the platform absorbs load spikes without provisioning; blue-green deployments avoid deploy-related downtime on the redirect path.
- Recovery objectives: Target RTO of 4 hours and RPO of 1 hour for the primary datastore.
- Testing: Backup restores are tested monthly; DR runbooks are reviewed after each test.
9. Data Lifecycle
- Deletion: Account deletion soft-deletes and then anonymizes personal data; deleted records are purged from backups within the 35-day backup cycle.
- Analytics retention by tier: 30 days (Free), 1 year (Pro), 3 years (Business), unlimited/custom (Enterprise); expired analytics are deleted automatically from the partitioned event store.
- Minimization: Coarse (city-level) geolocation is read from the Cloudflare edge that already terminates the request, so no IP address is sent to a separate geolocation vendor; stored analytics retain only truncated/pseudonymized IPs. Precise geolocation is never collected.
- Logs: Server and security logs are retained for 90 days; consent records for 5 years.
10. Compliance Posture
| Area | Status |
|---|---|
| GDPR / UK GDPR | DPA with SCCs (Modules Two/Three), UK Addendum, and Swiss adaptations available to all customers; self-service export and deletion |
| CCPA/CPRA | Service-provider terms in the DPA; "Do Not Sell or Share" mechanism and GPC signals honored |
| SOC 2 Type II | Planned. We are not committing to a report date until an auditor is engaged — we would rather name no date than miss a published one. Interim security documentation available under NDA |
| PCI DSS | Card data is handled entirely by our payment provider; LeonAI qualifies as SAQ-Aand never stores, processes, or transmits full card numbers |
| Penetration testing | Annual third-party penetration test; executive summary available under NDA to Business and Enterprise customers |
| Vulnerability disclosure | Public Responsible Disclosure Policy with safe harbor |
11. Subprocessor Security
All subprocessors (Cloudflare, Sumit, Resend, Sentry, Google Safe Browsing — see the Subprocessors page) are bound by data processing agreements with security obligations at least as protective as our DPA, and are reviewed for security posture before onboarding and at least annually thereafter.
12. Personnel Security
Background checks are performed where lawful; all staff sign confidentiality agreements, complete security and privacy training at hire and annually, and lose all access immediately on offboarding through a documented checklist.
13. Recommendations for Customers
To keep your account secure: enable MFA; create scoped API keys per integration and rotate them periodically; never embed API keys in client-side code or public repositories; verify webhook signatures (HMAC SHA-256) before trusting payloads; restrict team roles to least privilege; and keep the DNS records for your custom domains under change control.
14. Contact
Security questionnaires, audit requests, and documentation: care@leonai.io. To report a vulnerability, use the Responsible Disclosure Policy (subject line "Security Vulnerability Report"). To report an abusive link, use the Acceptable Use Policy (subject line "Abuse Report").