Skip to main content

​
Overview

Security in this integration is layered, and each layer answers a different question:

Channel

Protects the data in transit between Platform and the Partner endpoint. Provided by TLS on every outbound connection.

Message

Proves that what was sent was produced by Platform and was not altered — the HMAC-SHA256 signature specified in Data Integrity.
Neither layer replaces the other. TLS protects the connection, but it does not survive TLS-terminating proxies, load balancers, or API gateways: past that point the application can no longer tell which system opened the connection. The signature travels with the payload, so it stays verifiable wherever the request is finally processed.

​
Standard mechanisms

Every request Platform sends to a Partner is protected by the following mechanisms. They apply to all Partners and all environments, with no configuration on the Partner’s side beyond what is listed under Partner requirements.

​
Partner requirements

To receive these requests, the Partner endpoint must:
  • Be exposed over HTTPS. Platform validates the server certificate against the standard public trust store, so the certificate must be valid, in date, and issued by a publicly trusted CA. Self-signed certificates and private internal CAs are not supported.
  • Support TLS 1.2 or higher. Earlier versions are not negotiated.
  • Validate the signature on every request before executing any business logic, as described in Data Integrity.

​
Optional network controls

At the Partner’s request, the connection can additionally be placed behind one of the following. Both are agreed and configured with the Partner during the integration phase.

Site-to-site VPN

An encrypted tunnel between both infrastructures, so the traffic does not traverse the public internet.

IP allowlisting

Platform provides the fixed set of egress IP addresses its requests originate from, so the Partner can restrict inbound traffic to those addresses.
These controls narrow where a connection may come from; they do not establish which system produced a given request. The HMAC-SHA256 signature is what proves the request was issued by Platform, and it remains mandatory whether or not one of these controls is in place.

​
Scope

The mechanisms on this page, together with the signing scheme in Data Integrity, are the complete set of security controls Platform provides for this integration. Client certificates (mTLS), API keys, OAuth and other partner-specific schemes are not part of it. If your security review calls for something not listed here, raise it during the integration phase at support@leapfinancial.com so it can be assessed before implementation begins.