Trust Center
Where your data goes and how we protect it, for CogniRunner, Sentinel Vault, LeanZero Management and leanzero.net.
Last updated: October 4, 2026
Application Security
- All three apps run on Atlassian Forge and store their data in Forge storage on your Atlassian site. Apart from the optional MCP demo servers a CogniRunner administrator can connect, we run no servers that receive app data.
- Sentinel Vault and LeanZero Management carry Atlassian’s Runs on Atlassian badge: they send no data outside Atlassian. CogniRunner does not, because it can connect to AI providers, MCP servers and git hosts you choose.
- Every connection uses HTTPS.
- Keys you give an app are stored on your site, never in our source code. CogniRunner keeps AI provider keys, git tokens, webhook secrets and MCP server credentials in Forge’s encrypted secret storage. It stores no Atlassian deploy identity: a deploy pipeline reads FORGE_EMAIL and FORGE_API_TOKEN from secrets you add to your own repository.
- Sentinel Vault’s source code is public under the Apache License 2.0. CogniRunner and LeanZero Management are commercial; their data flows and permissions are documented on their product pages.
Data Privacy
- LeanZero SRL is registered in Romania and subject to the GDPR.
- App data and each app’s backup live on your own Atlassian site. The backups survive an uninstall so you can restore your setup; the Privacy Policy says how to delete them.
- Data residency: data in persistent Forge storage follows your site’s data residency where Atlassian supports it. Atlassian gives no residency commitment for app logs or Forge LLM requests, and data CogniRunner sends to a service you connect is outside it.
- The apps send no analytics or telemetry to us. Atlassian shows us the apps’ operational logs, which can contain account IDs and short excerpts, unless your administrator turns log sharing off.
AI Data Processing
- All three apps use Forge LLM by default, which runs Anthropic Claude models on Atlassian’s platform. The model call stays inside Atlassian. In CogniRunner, tools you turn on, such as MCP servers, web search and git, still reach their own services.
- In CogniRunner your administrator can connect another AI provider with your own key. That provider then works under your agreement with it, not ours.
- The AI advisors on our service pages use Anthropic, which does not train on API data. Each chat says it is an AI assistant.
- We are the provider of these AI systems under the EU AI Act and say where AI is used. Outputs are probabilistic and can be wrong; review what matters.
Compliance
- We are the controller for our website and services, and a processor for our app customers under our Data Processing Addendum.
- Transfers outside the EEA rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, except the two services the table below marks as having no agreement.
- We follow Atlassian’s Security Bug Fix Policy for our cloud apps.
- LeanZero SRL, CUI 51336260, EUID ROONRC.J2025012835002.
Sub-Processors
| Provider | Purpose | Data Processed | Location | Transfer safeguard | Used for |
|---|---|---|---|---|---|
| Atlassian (Forge platform, including Forge LLM) | Hosts and runs our Marketplace apps, stores their data, and runs their AI features on Atlassian-hosted models | The Jira and Confluence content the apps work on, app configuration and logs, AI prompts and answers | Atlassian's cloud infrastructure. Data in persistent Forge storage follows your site's data residency where Atlassian supports it; Atlassian gives no residency commitment for app logs or Forge LLM requests | Atlassian's data processing addendum (Standard Contractual Clauses) and its EU-U.S. Data Privacy Framework certification | Marketplace apps |
| Microsoft (Microsoft 365) | Our business mailbox, office@leanzero.net: enquiries, quotes, support, security reports and privacy requests | Name, email address, message content and attachments | Microsoft's cloud infrastructure | Microsoft's data protection addendum (Standard Contractual Clauses) and its EU-U.S. Data Privacy Framework certification | Support; Website; LeanZero Link and MCP demo servers |
| Atlassian (Jira Service Management) | Our support portal at leanzero.atlassian.net | Name, email address and the content of your request | Atlassian's cloud infrastructure | Atlassian's data processing addendum (Standard Contractual Clauses) and its EU-U.S. Data Privacy Framework certification | Support |
| Atlassian (our demo site) | Hosts leanzero-demo.atlassian.net, where we create evaluator accounts and keep one private work item per evaluator | Email address, name you set on the Atlassian account, Atlassian account ID, access dates | Atlassian's cloud infrastructure | Atlassian's data processing addendum (Standard Contractual Clauses) and its EU-U.S. Data Privacy Framework certification | Website |
| Amazon Web Services (Amplify, CloudFront, CloudWatch) | Hosts leanzero.net and its server logs | IP address, browser details, requested URLs, server log lines | London (eu-west-2), plus CloudFront edge locations worldwide | United Kingdom adequacy decision; AWS's data processing addendum (Standard Contractual Clauses) for edge locations | Website |
| PostHog | Website analytics, and session replay if you accept analytics cookies | Pseudonymous usage events, device and browser details, replays of pages viewed | EU (Frankfurt) | No transfer outside the EEA | Website |
| Resend | Sends our emails (form receipts, keys, sign-in codes, newsletter) and holds the newsletter list | Email address, name if given, the content of the email | United States | Resend's data processing addendum (Standard Contractual Clauses) and its EU-U.S. Data Privacy Framework certification | Website; LeanZero Link and MCP demo servers |
| Sanity | Content platform for leanzero.net: comments, guest submissions, exam and demo key records, demo site access records, benchmark runs | Name and comment text, submission details, email addresses on key and demo access records, benchmark entries | EU (Belgium), with a worldwide content delivery network for published content | Sanity's data processing addendum (Standard Contractual Clauses) where data leaves the EEA | Website |
| Anthropic | Runs the AI advisors on our service pages and drafts a summary of quote requests | Your chat messages and, for a quote request, your name, email, message, answers and the chat | United States | Anthropic's data processing addendum (Standard Contractual Clauses) | Website |
| Serper | Web search: for the AI advisors, and for MCP Web Search demo keys used without your own Serper key | Search queries (the advisor writes them from your conversation to look up public facts) | Not stated by Serper | Serper publishes no data processing agreement; we have none in place with it. Queries are written to look up public facts, not about you | Website; CogniRunner, only with our MCP demo servers |
| Z.AI | Optional image text recognition in the MCP Doc Processor demo, when you use it without your own Z.AI key | The images you send for text recognition | Outside the EEA (Z.AI does not state where) | No adequacy decision and no data processing agreement in place; used only if you send images for recognition | CogniRunner, only with our MCP demo servers; LeanZero Link and MCP demo servers |
| Calendly | Booking a call with us | Name, email and the booking details you enter | United States | Calendly's data processing addendum (Standard Contractual Clauses) and its EU-U.S. Data Privacy Framework certification | Website |
| Tailscale | Network access to our LeanZero Link sign-in service and our MCP demo servers | IP address and connection metadata; Link device traffic is end-to-end encrypted | Tailscale's cloud infrastructure | Tailscale's data processing addendum (Standard Contractual Clauses) | LeanZero Link and MCP demo servers; CogniRunner, only with our MCP demo servers |
The “Used for” column shows what each provider serves. For our Marketplace apps that is Atlassian, the support tools (our mailbox and support portal), and, only if a CogniRunner administrator connects our MCP demo servers, Tailscale, Serper and Z.AI. AI providers, MCP servers and git hosts you connect to CogniRunner yourself are not our sub-processors.
Incident Response
- Support and security response run 24 hours a day, every day.
- Report vulnerabilities to office@leanzero.net or through the “Report a security vulnerability” form on our support portal. We acknowledge reports within 24 hours and offer safe harbor for good-faith research.
- We fix vulnerabilities in our cloud apps within Atlassian’s timelines, counted from when they are reported or triaged: critical 10 days, high 4 weeks, medium 12 weeks, low 25 weeks.
- If we discover or are told of an actual or suspected security incident, including a vulnerability or compromise of one of our apps, we notify Atlassian within 24 hours. If customer data in an app is affected, we notify the customer without undue delay and within 48 hours; as their processor, we leave notifying the authority to them. For data we control, we notify the supervisory authority within 72 hours where Article 33 GDPR applies.
- We intend to join Atlassian’s Marketplace Security Bug Bounty Program; the policy page will link to it when we do.
Documentation & Resources
- Privacy Policy: what each product collects, who receives it, how long we keep it
- Data Processing Addendum: GDPR Article 28 terms for app customers, applies automatically
- Terms of Service: licences, AI features, liability
- Support SLA: 24/7 support, response times, security commitments
- Vulnerability Disclosure Policy: scope, safe harbor, how to report
- security.txt: machine-readable security contact
- CogniRunner documentation: features, AI providers, permissions
- Sentinel Vault documentation: features, data and backup
- LeanZero Management documentation: features, data and backup
- Sentinel Vault source code (GitHub): Apache License 2.0
Security & Privacy Contact
For security reports, privacy requests (including GDPR data subject rights), a countersigned DPA, or documentation not listed above, contact us any day of the week:
LeanZero SRL
Email: office@leanzero.net
Str. Toamnei 23 G, CAM. 1, Loc. Bragadiru, Jud. Ilfov, Cod 077025, Romania