LeanScale embeds delivery teams inside our clients' own SaaS tenants. We retain minimal data, operate as a data processor under each client's DPA, and run on SOC 2-attested infrastructure. This is our posture, in plain sight.
LeanScale provides human talent, not software. Customer production data resides in each client's own SaaS tenants — primarily Salesforce. Our internal footprint is small and runs on attested providers. Everything below is operating now.
Our latest CSA CAIQ self-assessment covers 261 items. The 25 "No" answers are our honest SOC 2 roadmap — see Roadmap. The full workbook is available on request.
These sub-processors support LeanScale's internal operations and engagements. Client CRM and similar data primarily resides in the client's own tenant; this register reflects the services LeanScale uses on its own behalf. All are SOC 2 (and where noted, ISO 27001) attested, with DPAs in place.
| Vendor | Purpose | Data handled | Region | Attestation | DPA |
|---|---|---|---|---|---|
| Salesforce | CRM platform | Client CRM data | US | SOC 2ISO 27001 | Yes |
| Supabase / AWS | App database & hosting | Minimal app data | US | SOC 2 | Yes |
| Netlify | App hosting / CDN | App assets | US | SOC 2 | Yes |
| Google Workspace | Email / docs / identity | Internal + correspondence | US | SOC 2ISO 27001 | Yes |
| Slack | Messaging | Internal comms | US | SOC 2ISO 27001 | Yes |
| GitHub | Source control | App code / config | US | SOC 2 | Yes |
| Bitwarden | Password manager | Secrets | US | SOC 2 | Yes |
| Rippling | HRIS / MDM / LMS | Employee data | US | SOC 2 | Yes |
| SentinelOne | EDR | Endpoint telemetry | US | SOC 2 | Yes |
If a sub-processor notifies LeanScale of a breach affecting data processed on a client's behalf, we relay the relevant details to affected clients per the applicable DPA. The client remains the data controller.
Because LeanScale's people work inside client-owned environments operated by third-party platforms, security responsibility is shared three ways. Each area has a designated primary owner — no control is assumed to be handled by someone else.
Identity & access for its staff, endpoint security, personnel screening & training, and how its people handle client data. Processes client data only on the client's documented instructions.
Its SaaS tenants, the data in them, tenant configuration, and all data-controller duties under applicable privacy law. Classifies its data and grants LeanScale the specific access an engagement requires.
SOC 2-attested platforms — Salesforce, Supabase/AWS, Netlify, Google, and similar — own and attest the physical, network, and platform/application security underpinning the systems in scope.
The full responsibility matrix — encryption, configuration, change management, incident response, backups — is in our Shared Responsibility Model document, available on request.
In the spirit of transparency, the capabilities below are planned but not yet implemented. They make up our SOC 2 roadmap and correspond directly to the "No" answers in our CAIQ self-assessment.
Policies, plans, registers, and the full CAIQ workbook are available under NDA. Tell us a bit about you, sign the NDA, and our security contact follows up by email.
Our security contact will review and follow up by email with access to the relevant documents. Thanks for your interest in LeanScale's security posture.
