Clear boundaries.
Confidence in every decision.

Leera uses PostgreSQL row-level security for workspace data isolation, with project roles and permission groups for supported project workflows. Workspace administrators, instance administrators and project members have different responsibilities. During setup, map the permissions your team needs and validate sensitive workflows with representative accounts. Review public document links separately, because publishing a document creates a way to read it outside the signed-in workspace.

QA credential passwords, stored AI provider keys and designated instance credentials use AES-256-GCM encryption. Normal QA credential reads show whether a secret is stored; reading the value requires a separate, permission-checked reveal action. For self-hosted recovery, keep the matching application secret key with the database backup. Encryption for storage volumes, file backups and external services is part of the deployment configuration and operating plan.

Supported AI clients can connect through an OAuth consent flow, and clients that use a manual connection can use an MCP access token. Review the requested scopes and project selection before granting access. Token management lets the owner inspect and revoke their credentials, and MCP checks token expiry and revocation when authenticating requests. QA password retrieval has a separate secrets scope. Revoke unused connections and include connected clients in regular access reviews.

AI requests go to the provider and endpoint configured for the workflow. On a self-hosted instance, you can choose supported cloud providers or compatible endpoints running on your network. Review the model capabilities, access settings and provider data terms before enabling a workflow. Application hosting and AI processing are separate choices; provider retention and training terms need to be confirmed for the service and agreement you use.

Scheduled agent execution views include status and associated agent messages. Supported step-by-step AI flows also record execution traces with tool outcomes and verification results. Use the records available for your workflow to investigate behavior and review important changes. Trace retention follows the instance settings, so agree on the history your team needs and how it will be preserved as part of your operating plan.

Your team chooses and operates the application infrastructure, including the server or cluster, database, file storage and network access. You also decide which services the instance can reach. Licensing, updates, AI, email and integrations have their own connectivity requirements; paid offline licensing can be arranged for isolated environments. Define ownership for hosting, service credentials, monitoring, updates and recovery before rollout.

The Docker Compose stack includes Caddy, which can provision public HTTPS when a domain points to the server and the required ports are reachable. The Helm chart supports TLS at your ingress. Configure and verify the certificates and network path your team will use. Internal service connections and external database or storage connections need their own transport review; a public HTTPS address covers the connection to that entry point.

The in-app update flow requires verified release information from an Ed25519-signed manifest. The supported updater checks published image digests when supplied, then applies the release through its backup, migration, restart and health-check stages. Keep the database, matching secret key, deployment configuration and uploaded files together in your recovery plan. Copy backups off the host and test a restore. Returning to older images does not reverse database migrations.

Yes. Bring your questionnaire, required controls and evidence needs to the Leera team. We can work through architecture, data handling, deployment choices and contractual requirements with your security and procurement stakeholders. Confirm the current documentation and certification or independent-audit status directly during that review. An enterprise engagement can include dedicated coordination, a representative pilot and an agreed plan for the controls and operating responsibilities your organization requires.

Email support@leera.io with the affected feature or URL, the Leera version if known, the potential impact and clear reproduction steps. Include only the evidence needed to explain the issue, with credentials and customer information removed. Use this private contact route for vulnerability details so the team can coordinate the investigation and follow-up with you.