> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leapfinancial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Communication Security

> TLS on every connection, signed requests, and the optional network controls available on request

## Overview

Security in this integration is layered, and each layer answers a different question:

<CardGroup cols={2}>
  <Card title="Channel" icon="lock">
    Protects the data **in transit** between Platform and the Partner endpoint. Provided by TLS on every outbound connection.
  </Card>

  <Card title="Message" icon="signature">
    Proves that **what** was sent was produced by Platform and was not altered — the HMAC-SHA256 signature specified in [Data Integrity](/vna/client-interfaces/data-integrity).
  </Card>
</CardGroup>

Neither layer replaces the other. TLS protects the connection, but it does not survive TLS-terminating proxies, load balancers, or API gateways: past that point the application can no longer tell which system opened the connection. The signature travels with the payload, so it stays verifiable wherever the request is finally processed.

## Standard mechanisms

Every request Platform sends to a Partner is protected by the following mechanisms. They apply to all Partners and all environments, with no configuration on the Partner's side beyond what is listed under [Partner requirements](#partner-requirements).

| Mechanism | What it provides |
| - | - |
| **TLS on every connection** | Confidentiality of the data in transit. TLS is mandatory — Platform does not issue requests over plaintext HTTP. |
| **HMAC-SHA256 request signing** | Authenticity and integrity at the message level. The signature travels in the `X-Signature` header and the Partner must validate it before processing the request. Fully specified in [Data Integrity](/vna/client-interfaces/data-integrity). |
| **Managed secrets** | The shared signing key, and any other credential used by the integration, are held in a secrets manager. They are never stored in source code or in repositories. |

## Partner requirements

To receive these requests, the Partner endpoint must:

* **Be exposed over HTTPS.** Platform validates the server certificate against the standard public trust store, so the certificate must be valid, in date, and issued by a publicly trusted CA. Self-signed certificates and private internal CAs are not supported.
* **Support TLS 1.2 or higher.** Earlier versions are not negotiated.
* **Validate the signature on every request** before executing any business logic, as described in [Data Integrity](/vna/client-interfaces/data-integrity).

## Optional network controls

At the Partner's request, the connection can additionally be placed behind **one** of the following. Both are agreed and configured with the Partner during the integration phase.

<CardGroup cols={2}>
  <Card title="Site-to-site VPN" icon="network-wired">
    An encrypted tunnel between both infrastructures, so the traffic does not traverse the public internet.
  </Card>

  <Card title="IP allowlisting" icon="list-check">
    Platform provides the fixed set of egress IP addresses its requests originate from, so the Partner can restrict inbound traffic to those addresses.
  </Card>
</CardGroup>

<Note>
  These controls narrow **where** a connection may come from; they do not establish **which** system produced a given request. The HMAC-SHA256 signature is what proves the request was issued by Platform, and it remains mandatory whether or not one of these controls is in place.
</Note>

## Scope

<Info>
  The mechanisms on this page, together with the signing scheme in [Data Integrity](/vna/client-interfaces/data-integrity), are the complete set of security controls Platform provides for this integration. Client certificates (mTLS), API keys, OAuth and other partner-specific schemes are not part of it. If your security review calls for something not listed here, raise it during the integration phase at [support@leapfinancial.com](mailto:support@leapfinancial.com) so it can be assessed before implementation begins.
</Info>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.