Security
Built like a security product.
A compliance tool talks to every host you own. Here is how LEA Platform keeps that channel, its data and its releases trustworthy.
Last updated: 2026-10-14
Agents earn their place.
- New agents enroll with a deployment token for a specific group. Tokens are shown once and can be rotated or revoked at any time.
- After enrollment each agent holds its own client certificate; from then on it talks to the server over mutual TLS.
- Certificates renew automatically. Lost or broken identities re-enroll by proving possession of their key, or through a time-limited re-enrollment window an admin opens.
- An agent that needs to re-prove itself is put on probation: it receives no rules that carry secret parameters until it is trusted again.
Agents only obey their server.
Every response the LEA server sends to an agent is signed with Ed25519 and time-stamped. Agents pin the server's public key and reject responses that are unsigned, altered or older than the allowed window.
The host never grades itself.
Agents send raw command output, never verdicts. The expected values stay on the server: an agent receives only the commands to run, so it never sees what "pass" looks like. Rules are changed only in the console.
Your data stays with you.
- LEA Platform is self-hosted. System data goes from your hosts to your LEA server and nowhere else.
- No call-home: the license is an offline file bound to your server.
- The AI assistant is optional and uses a local model by default; external providers are opt-in.
- Database backups are encrypted (AES-256) and can go to local disk, SSH or S3-compatible storage, each with its own retention.
Evidence that shows tampering.
Every evidence record is signed with HMAC-SHA256 under a rotating key when it's recorded. Admin actions and outgoing notifications are written to separate audit logs.
Who can see and change what.
- Single sign-on with OIDC (Keycloak or Microsoft Entra ID), or local accounts.
- Admin and read-only roles.
- Agent-facing and admin APIs are separated; legacy agent endpoints can be limited to gateway certificates or turned off.
Releases you can verify.
LEA Platform releases are signed, published with checksums and a CycloneDX SBOM, and distributed to customers through a private portal with security advisories. Agent updates are checked by file name and hash before they're applied.
Found something? Tell us.
Email security@gsr-it.com with details and steps to reproduce. We acknowledge reports within 3 days and keep you updated until a fix ships. Please give us reasonable time to fix before public disclosure.
FAQ
Try it on your own servers.
30 days, up to 25 endpoints, every feature. We help you install it and agree on success criteria first.