- Your process content is never used to train AI models, ours or our AI provider's.
- Your account and saved analyses are stored in Seoul, South Korea.
- You can delete your account and everything in it yourself, at any time.
- Our database, AI and payment providers hold independent SOC 2 Type II reports. LeanBean's own SOC 2 report is on our roadmap.
1Security at a glance
Encrypted in transit
All traffic to leanbean.cc uses HTTPS, enforced with HSTS so browsers never connect over plain HTTP.
Your data stays yours
Row-level security is enabled on every database table. Each user can read and change only their own records.
Billing can't be edited from the browser
Your plan status is written only by our payment system's verified webhook, never by the app in your browser.
Authenticated AI requests
Every analysis request is checked against a signed session token on our servers and is subject to usage limits.
Passwords never stored in plain text
Passwords are hashed with bcrypt by our authentication provider. You can also sign in with Google.
Hardened browser defences
A strict Content Security Policy, frame blocking and a restrictive permissions policy apply to every page.
The database is backed up daily, and each backup is kept for 7 days.
2Who processes your data
We use a small number of established providers. Each is listed here with what it does and the data it handles.
| Provider | Purpose | Data handled | Assurance |
|---|---|---|---|
| Supabase | Database and sign-in | Account details and saved analyses, stored in Seoul, South Korea | SOC 2 Type II |
| Anthropic | AI analysis | The process content you submit for each analysis | SOC 2 Type II |
| Netlify | Website hosting and server functions | Requests passing between your browser and our services | SOC 2, ISO 27001 |
| Stripe | Subscription payments | Billing details. We never see or store full card numbers. | PCI DSS Level 1, SOC 2 Type II |
| Optional sign-in with Google, and web fonts | Your name and email if you choose Google sign-in, and standard browser request data when fonts load | Google privacy policy |
Our AI, hosting, payment and sign-in providers may process data outside Singapore and South Korea. We rely on each provider's contractual safeguards for those transfers.
3Your data and AI
What we store. Your account email and name, the process descriptions and files you submit, and the maps and analyses generated from them. We keep this so you can return to your work.
No training on your content. We don't use your content to train AI models. Under Anthropic's commercial terms, our AI provider is not permitted to train its models on it either.
How long the AI provider keeps it. Anthropic deletes API inputs and outputs within 30 days. It keeps them longer only where content is flagged under its usage policy or where the law requires it.
No selling. We don't sell your data or share it with advertisers.
4You stay in control
- Delete everything yourself. Account settings → Delete account permanently erases your profile, every saved analysis and your login, straight away. Deleted data drops out of our database backups as they expire, within 7 days.
- Export your work. Download any analysis as a PDF or PowerPoint file from inside the app.
- Get a full copy of your data. Email privacy@leanbean.cc and we'll send it to you within 30 days.
- Your privacy rights. You can ask to access, correct or delete your personal data under Singapore's PDPA, the GDPR or similar laws. See our Privacy Policy.
Billing records held by Stripe are kept for the period the law requires, even after you delete your account.
5Compliance roadmap
We would rather tell you exactly where we stand than show a badge we haven't earned.
-
Infrastructure providers' SOC 2 Type II reportsOur database, AI and payment providers each hold an independent SOC 2 Type II report.In place
-
Data Processing AgreementA standard DPA for business customers.In preparation
-
LeanBean SOC 2 Type IIAn independent audit of LeanBean's own controls. LeanBean does not hold this report today.On our roadmap
6Report a security issue
If you believe you've found a security vulnerability in LeanBean, email security@leanbean.cc. Please include enough detail for us to reproduce it.
We'll acknowledge your report within 3 business days and keep you updated while we fix it. We ask that you don't access other users' data, disrupt the service, or disclose the issue publicly before we've had a reasonable chance to resolve it.