TRUST AND COMPLIANCE

Trust and compliance.

Public verification, encryption posture, sub-processors, and compliance roadmap for Leopoldo. Built for procurement review by regulated finance teams.

Audit verification

Every deliverable signed by Leopoldo carries a witness marker with a public Audit ID. Anyone holding the ID can verify the deliverable's integrity at trust.leopoldo.ai/v. No account, no auth.

The verification page recomputes the per-client hash chain and validates the Ed25519 signature against the published audit public key. Tampering with the deliverable, the chain row, or any prior row breaks verification.

Public audit key

Download the Ed25519 audit public key for offline verification with openssl. The same key is also embedded inside every delivered package at keys/audit-public-key.pem when configured.

Offline verification (one-liner): hash the deliverable body without the witness marker block, then compare to the content_hash returned by /api/audit/verify/{audit_id} and verify the signature with openssl pkeyutl -verify.

Sub-processors

Current list of third-party processors used to deliver Leopoldo (hosting, email, error monitoring, billing). We maintain this list in our procurement pack; request the current version at trust@leopoldo.ai. Material changes are notified to clients with a 30-day notice per our DPA.

Encryption posture

  • In transit: TLS 1.3 to all public endpoints (api.leopoldo.ai, leopoldo.ai, trust.leopoldo.ai).
  • At rest: Neon Postgres with AES-256 transparent disk encryption (Frankfurt, EU).
  • Application-level: AES-256-GCM field-level encryption for OAuth tokens and other sensitive data; keys are environment-scoped.
  • Audit signing: Ed25519 keypair, private key never leaves the Railway environment in Phase 1 (HSM/KMS in Phase 2).

Compliance roadmap

  • Information Security Management System aligned to ISO 27001 controls (15-policy pack, internally maintained).
  • GDPR Art. 28 compliant. DPA available on request with Standard Contractual Clauses for any non-EU transfer.
  • Per-deliverable cryptographic chain of custody for MiFID II evidence-of-record and DORA traceability requirements.
  • Right-to-audit clause supported by replay endpoint and published public key.

Contact

Procurement, security review, DPA, and compliance inquiries: trust@leopoldo.ai

Data protection requests: dpo@leopoldo.ai