Skip to content
LEA Platformby GSR

Self-hosted configuration compliance for Linux, macOS and Windows

Compliance evidence your auditor can trust.

LEA Platform checks every host against your hardening rules, fixes drift where you allow it, and turns every result into signed evidence for IT, security, GRC and your auditor. On your servers.

Start a free POCSee how it works

Free for 30 days on up to 25 endpoints. Every feature included.

No SaaS dependency No inbound ports on your hosts No feature tiers

How it works

  1. 1

    Collect.

    A small agent on each host runs read-only commands and sends back the raw output.

  2. 2

    Judge.

    The LEA server compares that output with each rule's expectations and records pass or fail.

  3. 3

    Fix.

    If you attached a remedy to the rule, LEA runs it and checks again.

  4. 4

    Prove.

    Results become signed evidence snapshots and reports for every stakeholder.

See the full flow

Trustworthy results

A host can't grade its own homework.

  • Agents only collect raw system state. The pass/fail decision is made on the LEA server.
  • Agents enroll with a one-time deployment token and talk over mutual TLS.
  • Every server response is signed and checked by the agent, so commands can't be forged in transit.
Host overview: raw output on the left, the server's verdict on the right.

Remediation

Drift goes back to policy. With a record.

  • Attach a remedy to any rule. When the check fails, LEA runs it and checks again.
  • Remedies are opt-in per rule, so you decide what may change on its own.
  • Prefer your own automation? Run the same rules through Ansible or AWX.
One rule: what to check, what to expect, how to fix.

Evidence & reports

One run. Five audiences.

  • Evidence snapshots mapped to CIS Controls, ISO 27001, SOC 2 and CMMC, on a schedule you set.
  • Every evidence record is signed with HMAC-SHA256, so tampering shows.
  • Ready-made PDF reports for the IT Manager, CISO, GRC Technical, GRC Legal and the External Auditor.
Pick the audience; LEA writes the report.

Deployment

Your servers. Your data. A visible price.

  • Runs anywhere that runs containers: Docker Compose on a Linux host, Kubernetes, or a VM on AWS, Google Cloud or Azure. No call-home; the license is an offline file.
  • Ask questions in plain language with the optional AI assistant, running on a local model by default.
  • The rule library is open source, and every plan includes every feature.
Settings: your offline license, managed in the console.

Built for everyone who signs the audit.

Mapped to the frameworks you answer to.

LEA Platform produces evidence; certification is granted only by an accredited auditor.

Built like a security product.

Agents enroll with deployment tokens you can rotate and revoke, then hold their own mTLS certificate. The server signs its responses, and agents reject anything unsigned or stale. Releases are signed and published with checksums and SBOMs.

Read the security overview

  • Deployment tokens
  • Mutual TLS
  • Signed responses
  • Signed releases + SBOM

One server you own. Small agents everywhere else.

Linux · macOS · WindowsagentsHTTPS + mTLS,outbound onlyLEA server(your infrastructure)Rule engineEvidence signerReportsAuditAdmin consolePDF reportsWebhooks (Slack, generic)ElasticsearchLocal AI assistant

Deployment options

Check our work.

From $6 per endpoint per month.

Every feature in every plan. No quote needed to know what it costs.

See pricing

FAQ

Try it on your own servers.

30 days, up to 25 endpoints, every feature. We help you install it and agree on success criteria first.

Start a free POC