Skip to main content
Leenen PerformanceLEENENPERFORMANCE

Security

Built for coaches who handle real client data.

Health data, body photos, and payments deserve real security. Here's how we protect them and exactly which third parties touch your data.

Encrypted in transit and at rest

TLS 1.3 everywhere. AES-256 at rest on Postgres and object storage.

Postgres Row-Level Security on every table

Multi-tenant separation enforced at the database level — not just in app code. A coach physically cannot read another coach's data. We test this with an automated suite that runs on every deploy.

PCI: we never see card data

All card data is handled by Stripe. We hold a Stripe customer ID and a payment-method reference. Your liability surface stops at our front door.

Daily automated backups

Nightly automated database backups. Point-in-time recovery and cross-region replication are on the roadmap.

Audit logging on every state-changing action

Append-only audit log records who did what, when, from where. Append-only at the database role level — admins literally can't delete entries.

2FA on the roadmap

TOTP two-factor authentication, passkey (WebAuthn) support and a sign-out-everywhere button are on the roadmap. Today, sign-in is by magic-link email or Google / Microsoft sign-in with HTTP-only session cookies.

Compliance roadmap

  • Now
    Australian Privacy Act / APP
    Designed-in from day one. Data hosted in Australia (Brisbane, QLD).
  • Now
    GDPR-aligned practices
    Purpose limitation, minimisation, access and deletion; EU sub-processors documented. Our governing privacy framework is the Australian Privacy Act.
  • Now
    CCPA / CPRA
    California rights honoured; export, deletion, and opt-out from sale supported.
  • Roadmap
    SOC 2 Type 1
    Via Drata. Targeted as we scale into US enterprise rollouts.
  • Roadmap
    SOC 2 Type 2
    Issued after Type 1. Standard one-year continuous-monitoring window.
  • Roadmap
    HIPAA-tier (Unlimited plan)
    BAA + scoped tenancy for US healthcare/rehab coaches.

Subprocessors

We list every third party that processes data on our behalf. We notify paid-plan customers in advance of changes.

Provider
Leenen Performance (our own server, self-hosted Supabase)
What they do for us
Database, sign-in, file storage, realtime updates
Data involved
All Service data
Location
Australia
Provider
Vercel Inc.
What they do for us
Web app hosting and serverless functions; page performance metrics
Data involved
Requests, IP address, data in transit
Location
Australia (Sydney) for functions; global edge network; US company
Provider
Stripe (Stripe Payments Australia Pty Ltd, Stripe, Inc.)
What they do for us
Payments, coach payouts (Stripe Connect), tax
Data involved
Name, email, payment details (card data never touches Leenen)
Location
Australia, United States, global
Provider
Resend, Inc.
What they do for us
Email delivery (service emails and coach emails, with open and click tracking)
Data involved
Email address, name, email content
Location
United States
Provider
Mux, Inc.
What they do for us
Video upload and streaming
Data involved
Videos and video details
Location
United States
Provider
Google LLC: Firebase Cloud Messaging and Crashlytics
What they do for us
Push notifications; app crash reports
Data involved
Device token, notification content, account ID, device details
Location
United States
Provider
Google LLC: Google sign-in, Calendar API, Workspace email, STUN
What they do for us
Google sign-in, calendar features (if connected), our support mailbox, call connection set-up
Data involved
Email, name, calendar data, support emails, IP address
Location
United States, global
Provider
Microsoft Corporation
What they do for us
Microsoft sign-in and Outlook calendar (if connected)
Data involved
Email, name, calendar data
Location
United States, global
Provider
Apple Inc.
What they do for us
Push notifications (APNs); Apple Health on your device; Sign in with Apple (when available)
Data involved
Device token; Apple user ID or relay email
Location
United States
Provider
Functional Software, Inc. (Sentry)
What they do for us
Error monitoring
Data involved
Account ID, error details, masked error replays
Location
European Union (Germany)
Provider
PostHog, Inc.
What they do for us
Product analytics (website only with your consent; some server events)
Data involved
Account ID, feature-use events
Location
United States
Provider
AI gateway operated by JEL Tech Solutions
What they do for us
Routes AI requests to our AI provider
Data involved
AI feature inputs (see AI features)
Location
Australia
Provider
Anthropic, PBC (Claude)
What they do for us
AI features
Data involved
AI feature inputs (see AI features)
Location
United States
Provider
Call relay service
What they do for us
Relays encrypted call audio and video when a direct connection isn't possible
Data involved
IP address, encrypted media in transit
Location
Global or Australia, depending on the connection
Provider
Shorebird
What they do for us
Mobile app updates
Data involved
App version, platform
Location
United States
Provider
Strava, Inc. and Garmin Ltd. (not yet available)
What they do for us
Connected fitness accounts, only if you link them
Data involved
Activities and workout data
Location
United States

Found a vulnerability?

Email security@leenenperformance.com with details. We'll acknowledge within one business day and won't pursue legal action against good-faith research.