Security & Trust

• Production workloads are deployed in isolated AWS accounts using the AWS Well-Architected Framework;
• Infrastructure is defined as code (Terraform) and changes go through a change-management review process;
• Network segmentation is enforced through VPCs, private subnets, and security groups with default-deny rules;
• Internet-facing services are fronted by AWS WAF (Web Application Firewall) and AWS Shield for DDoS protection;
• Customer-selectable data residency is available for US (us-east-1, us-west-2) and EU (eu-west-1) regions; and
• Production environments are strictly separated from development and staging environments.

• Platform services are deployed across multiple AWS Availability Zones for fault tolerance;
• Automated health checks and auto-scaling ensure service continuity under load;
• Recovery Point Objective (RPO): 1 hour; Recovery Time Objective (RTO): 4 hours for Tier 1 services;
• Database backups: continuous point-in-time recovery with a 30-day retention window.

AWS data centres maintain comprehensive physical security controls including biometric access, 24/7 surveillance, and multi-zone perimeter security. For detailed AWS physical security controls, see the AWS Security whitepaper.

• All Customer Data stored in databases, object storage (S3), and backups is encrypted using AES-256;
• Encryption keys are managed via AWS Key Management Service (KMS);
• Key rotation is performed automatically on an annual basis (or on demand); and
• Backup data is encrypted with the same standards as production data.

• All data transmitted between clients and Lenera AI servers is encrypted using TLS 1.2 (minimum) or TLS 1.3 (preferred);
• HTTP Strict Transport Security (HSTS) is enforced with a max-age of one year;
• All API calls require HTTPS; plain HTTP requests are rejected or redirected; and
• Internal service-to-service communication within the platform is also encrypted in transit.

• All Lenera AI staff access to production systems requires multi-factor authentication (TOTP or FIDO2/WebAuthn hardware key);
• Production access is granted on a need-to-know, least-privilege basis and reviewed quarterly;
• Privileged access management (PAM) is enforced via time-limited, just-in-time access grants for sensitive operations;
• All access to production systems is logged and retained for a minimum of 12 months; and
• Access is revoked within 24 hours of employee offboarding.

• Customers authenticate via username/password (bcrypt-hashed, minimum 12 characters) or SSO (SAML 2.0 / OIDC via WorkOS);
• MFA is available to all customers and enforced on Enterprise plans;
• Admin accounts are restricted to named individuals and cannot be shared;
• Customer access to their data is strictly isolated — no customer can access another customer's data; and
• Audit logs of user actions are available to Customer administrators via the platform dashboard.

The platform supports granular RBAC with the following standard roles: Owner, Administrator, Editor, Viewer, and API-only. Custom roles are available on Enterprise plans. Permissions follow the principle of least privilege.

• Security requirements are integrated at every phase of the development lifecycle;
• All code changes undergo peer review before merging to production;
• Static Application Security Testing (SAST) is run automatically on every pull request;
• Dependency scanning (via Dependabot / Snyk) identifies vulnerable third-party libraries; and
• Dynamic Application Security Testing (DAST) is run against staging environments prior to major releases.

• Annual third-party penetration tests are conducted by an independent security firm;
• Findings are remediated according to a risk-tiered SLA (Critical: 7 days; High: 30 days; Medium: 90 days);
• Continuous automated scanning (OWASP ZAP equivalent) runs against production.

Lenera AI maintains a responsible disclosure programme. If you discover a security vulnerability, please report it to support@lenera.ai. We commit to:

• Acknowledging receipt within 2 business days;
• Providing an initial assessment within 5 business days;
• Working collaboratively toward a fix.

We do not initiate legal action against researchers acting in good faith under this programme.

Lenera AI operates continuous security monitoring using AWS CloudTrail, GuardDuty, and application-level logging. All security events are centralised in a SIEM for correlation and alerting. Incidents are classified into four severity tiers (Critical, High, Medium, Low) based on data impact, scope, and likelihood of harm.

In the event of a personal data breach affecting Customer data, Lenera AI will:

• Notify the affected Customer within seventy-two (72) hours of becoming aware of the breach, in compliance with GDPR Article 33 and applicable state breach notification laws;
• Provide a preliminary notification containing the nature of the breach, categories of data affected, likely consequences, and initial containment measures; and
• Provide a full incident report including root cause, remediation steps, and preventive measures as soon as practicable.

• Lenera AI maintains a documented Incident Response Plan (IRP) reviewed annually;
• A dedicated Security Incident Response Team (SIRT) is on call 24/7;
• Tabletop exercises are conducted at least annually; and
• Post-incident reviews are conducted for all Critical and High severity incidents.