LeanProjax — memo for IT & security teams

What it is

LeanProjax is a multi-tenant SaaS workspace for running Lean Six Sigma / DMAIC improvement projects: project charters, process data and measurements, statistical analysis (capability, SPC, MSA, hypothesis testing), and PDF tollgate reports. One of your employees is asking to use it with work-related process data; this memo summarises what a review typically needs to know. Fuller detail: security & trust · privacy policy · terms of service.

Hosting & transport

• Application, background workers, and PostgreSQL run on Railway managed infrastructure; all traffic (web app, admin console, API) is served over TLS.
• Providers may process data in the United States, the EU, and other regions; the current sub-processor list is in the privacy policy §6.

Tenant isolation

• Enforced in three independent layers: PostgreSQL row-level security with deny-by-default policies on every tenant table (a query that fails to name the organisation returns nothing — it fails closed), per-request organisation membership verification, and per-project role checks on top.
• The application’s database role cannot bypass row-level security; cross-tenant access paths are explicit and audited.

Authentication & sessions

• Sign-in via Apple, Google (OIDC), or email + password (Argon2id hashing, leaked-password screening available). Short-lived signed access tokens with rotating refresh tokens and reuse detection.
• Users can list and revoke their active sessions and devices; unrecognised sign-ins trigger an alert email with one-click revocation. The operator admin console is a separate domain with mandatory TOTP two-factor authentication.

Data handling

• Project content is never used to train AI models and never sold or shared for advertising.
• Error tracking (Sentry) runs with PII sending disabled and credential scrubbing; product analytics (PostHog) mask typed text and project content, with a user-level opt-out.
• The upload pipeline scans files for malware before parsing when file features are enabled. Optional AI-assisted features are off by default and disclosed in the privacy policy when enabled.
• The platform works from summary statistics (mean, standard deviation, sample size, counts) as a first-class input — raw records are optional for most analyses, which materially reduces what needs to be uploaded at all. See using LeanProjax with work data.

Backups & availability

• Managed PostgreSQL with daily volume backups plus continuous point-in-time recovery (both in place since August 2026); restore procedures are documented in internal runbooks.

Exit & deletion

• Any project exports as a complete package — Excel workbook, full-fidelity JSON, and PDF reports — at any time, without contacting us. There is no lock-in mechanism.
• Account deletion is self-service; associated personal data is deleted or anonymised within 30 days (privacy policy §8), subject to legal holds.

What we have not built yet

• No SOC 2 / ISO 27001 certification yet, and no formal third-party penetration test report — automated DAST, static analysis, and cross-tenant authorization testing run on a schedule instead; the security page describes both the controls and the gaps.
• No enterprise SSO (SAML) or SCIM provisioning yet — on the roadmap, not shipped.

Contact

Questions from a review go to info@leanprojax.com and are answered directly by the operator. LeanProjax is founded and operated by Nasser Al‑Sulaihim (15+ years of operational-excellence work in the banking industry).