Leon sees exactly what you are allowed to see.
Search, chat and MCP all enforce the permissions of the person asking. Below: what is in place today, and what isn’t yet.
What runs in production today.
Each point below describes code that is live in the product.
Tenant isolation
Each organization’s data is isolated at the database level with Postgres row-level security, and covered by automated tests.
Permission-aware retrieval
Search, chat and the MCP server run with the permissions of the person asking. Access is filtered before ranking, so hidden content never shapes a result.
Private conversations
AI assistant conversations, chats with Leon and saved notes are visible only to their author.
Encrypted credentials
API keys and OAuth tokens are encrypted with AES-256-GCM and bound to their database row.
Secret redaction
Known key prefixes, private keys, authorization headers and .env lines are redacted before storage.
Consent-first extension
Explicit consent, a per-site toggle and a pause button. Inactive in private windows, never captures attachments.
Audited MCP access
Each source an assistant opens in full over MCP (fetch) is logged. Personal tokens can be revoked at any time.
A single datastore
Text, search index, vectors and permissions all live in Postgres. No separate search cluster holds a copy of your data.
Two visibility rules cover everything Leon stores.
Shared with the team
Content from shared connections, as in the source tool. Email, Google Drive and Slack are the exception: they stay private to whoever connects them.
- Tickets, docs, meeting transcripts and CRM notes from shared connections
- Support conversations and shared inboxes (Front, Missive…)
- Each with a deep link to the original
Private to you
No one else sees it, in search results or in answers.
- Your AI assistant conversations
- Your chats with Leon
- Notes you save over MCP (remember)
- Your email (Outlook, Gmail), Google Drive and Slack, if you connect them
What’s missing.
We would rather you read it here than discover it later. This list is kept current.
- Source-tool permissions are not mirrored yet. Content from a connection is shared with the whole team, except email (Outlook, Gmail), Google Drive and Slack, which stay private to whoever connects them.
- A secret written in plain prose (“the password is…”) can slip past redaction.
- No data export yet, and no full account deletion from the interface.
- No ISO 27001 or SOC 2 certification yet.
Start with one tool and check the permissions yourself.
Create a workspace, connect a tool, and see exactly what is shared and what stays yours.