Compliance posture
What we've assessed, what we've shipped, what's next.
Leanroute Pte. Ltd. is a Singapore-incorporated company. Operations and primary data residency live in Singapore. The tables below say exactly what we do today against each major regulatory regime, where we're "best-effort" rather than certified, and what we're committed to land before our first SOC 2 audit.
A note on certifications
We are not SOC 2 / ISO 27001 certified at launch. SOC 2 Type II is on the 12-month roadmap. If you need an attestation before then, talk to us about a security questionnaire and an interim Data Processing Addendum — we'll meet you with documented controls and direct access to the engineering team that owns them.
Regulatory regimes
| Regime | Jurisdiction | Status |
|---|---|---|
| PDPA | Singapore | Aligned at launch Operated by Leanroute Pte. Ltd. (Singapore). Data residency in Singapore by default — compute, database, and cache all in-region. Required consent + access + correction + deletion rights are surfaced through /dashboard. Named sub-processors below. |
| PDPO | Hong Kong | Aligned at launch Same data-handling posture as PDPA covers the substantive PDPO obligations. Cross-border transfer to other Asia regions is documented in the privacy policy. |
| GDPR / UK GDPR | EU + United Kingdom | Best-effort at launch; DPA + SCCs on request We've designed for GDPR data-subject rights (access, correction, deletion, portability, objection). A signed Data Processing Addendum incorporating the EU Standard Contractual Clauses is available on request for any customer with EU data subjects. SOC 2 Type II planned for 12 months post-launch. |
| PIPL | China (mainland) | Suitable for cross-border traffic; not a domestic processor We route requests to Chinese providers (Qwen / GLM / Doubao / Kimi) on behalf of customers but do not operate inside the mainland. If you have PRC data-export obligations, BYOK with those providers is the path — the prompt content flows direct from our gateway in Singapore to the provider under your own keys. |
| APPI | Japan | Aligned at launch APPI's cross-border transfer requirements are met by our published privacy policy and the standard data-subject rights flow. No special opt-in is needed for Japan-origin traffic. |
| DPDP | India | Aligned at launch DPDP-compliant notice + consent baked into sign-up. India BYOK routes (Sarvam, Krutrim) keep prompt content domestic; managed routes flow through Singapore. |
Data residency in detail
Primary region: Singapore. Compute, database, and cache all run in-region. All HTTP requests are served from Singapore-hosted machines. Specific sub-processors and the regions they operate in are named in the Sub-processors section above.
Cross-border egress: requests routed to OpenAI, Anthropic, Google, Sarvam, and Krutrim leave the Singapore region to reach those providers (typically US-East or India). Requests routed to Qwen, GLM, Doubao, Kimi, and DeepSeek leave to provider regions in mainland China. Vision and text routing are vision-safe; we never silently drop image content while crossing providers.
BYOK shortcut: with BYOK keys configured for a provider, the deposit-balance decrement still happens at our Singapore gateway, but the actual token call is billed by the upstream provider directly to you under your own account. If you have stricter residency requirements (e.g. EU-resident data must stay in EU), BYOK with an EU-resident provider account is the cleanest path.
Other regions: EU and US-East deployments are available on request once we've seen the workload — we'd rather stand up a region for a real customer than guess at demand. Email [email protected] with the details.
Security controls
- Transport: TLS 1.2+ end-to-end, including between our gateway and dashboard services and between the gateway and every upstream provider.
- At rest: database and cache encrypted-at-rest by their managed providers (named in Sub-processors above). BYOK provider keys are additionally encrypted client-side with AES-256-GCM under a master key held only as a runtime secret — a leaked database dump is useless without the master.
- Per-org isolation: cache keys are namespaced
gw:cache:<type>:<orgId>:<hash>; a hit from one organization cannot satisfy a request from another, full stop. - No-persistence mode: a master switch per organization (/dashboard/settings) bypasses prompt + semantic caches entirely. We emit
x-gateway-prompts-persisted: falseso your monitoring can verify. A wipe-cache-now button deletes everything still in cache for your org. - Throttling: hard daily / monthly spend caps and RPM / TPM rate limits per org and per API key. Spend caps return 402 at the gateway edge before any upstream dispatch — runaway loops can't go past the wall you set.
- Audit trail: every credit-moving Stripe event is recorded in
processed_stripe_eventwith event id, type, amount, and timestamp. An hourly reconciliation job verifies the balance invariant automatically. - Secret hygiene: all secrets (DATABASE_URL, REDIS_URL, GATEWAY_BYOK_SECRET, STRIPE_WEBHOOK_SECRET, provider keys) are held in Fly's encrypted secret store, never committed to source.
Subprocessors
Updated when this list changes. Each subprocessor has its own DPA which we accept on our customers' behalf where the DPA permits it.
| Vendor | Role | Region | DPA |
|---|---|---|---|
| Fly.io | Compute (api + web) | Singapore (ap-southeast-1) | link → |
| Neon | Postgres (organization, request_log, BYOK keys) | AP regions (configurable) | link → |
| Upstash | Redis (prompt cache, throttle counters) | Singapore / AP | link → |
| Stripe | Payments (top-up Checkout) | Global | link → |
| Better Auth | Authentication (sessions) | Co-resides with Postgres | in-product |
| Grafana Cloud | Logs + metrics + error monitoring (with prompt scrubbing on the no-persistence path) | EU (Frankfurt) | link → |
Roadmap
- Q3 2026: SOC 2 Type I window opens. Internal controls baseline (access reviews, vendor management, incident response runbooks).
- Q1 2027: SOC 2 Type II audit completes (six-month observation window).
- On request: EU region (Frankfurt or Amsterdam) once a real EU-resident customer says when. Same code, same database tier, different region pin.
- On request: SAML / SSO for enterprise. Currently Better Auth + email + GitHub OAuth.
Reaching us
Security disclosures: [email protected].
Data-subject requests, DPA / SCC signing, procurement questionnaires: [email protected].
Service status: status.leanroute.dev.
See also: Terms · Privacy · Integration guides · Home