Get a Demo

Security

Effective date: 15 July 2026

Telecom operators, governments and enterprises trust Lepton with network, location and infrastructure data. This page describes how we protect it and how to reach us about security.

Compliance

Lepton is undergoing a SOC 2 Type II audit.

Customers and prospects can request our security documentation, including completed security questionnaires and our Data Processing Agreement, by writing to info@leptonsoftware.com. Audit reports are shared under a confidentiality agreement.

Where customer data lives

  • Our products are deployed on infrastructure the customer owns or chooses. Lepton does not keep customer production servers on its own premises.
  • Each customer's data is kept separate from every other customer's data.
  • Monitoring and backups for each deployment follow the customer's own requirements.
  • Data in transit is encrypted with TLS. Our website accepts only HTTPS connections.

Secure development

Code changes are reviewed before release, following our software development lifecycle (SDLC).

People

  • Every employee signs a confidentiality agreement.
  • Employees complete security training every year.
  • Background checks are run on new hires.

Vendors

We assess the security of vendors that process personal data for us and bind them by contract. The current list is on our Subprocessors page.

Reporting a vulnerability

If you believe you have found a security vulnerability in a Lepton website or product, please tell us. Email info@leptonsoftware.com with the subject line "Security report" and include:

  • the affected URL or product;
  • a description of the issue and its impact;
  • the steps needed to reproduce it.

We will acknowledge your report, keep you updated, and tell you when it is fixed.

Please do not

  • access, change or delete data that is not yours;
  • run denial-of-service tests, spam our forms or use social engineering against our staff;
  • disclose the issue publicly before we have fixed it.

If you act in good faith and follow these guidelines, we will not take legal action against you for your research. We do not currently run a paid bug bounty.

Our security.txt file lists the same contact for automated tools.