Security and trust
What has been independently audited, at what scope, and how the platform handles data, deployment and audit. Each audit report or certification is listed the week it is issued, with a plain note on what it covers, and never before.
Audits and certifications
The report is available under NDA to institutions evaluating Lean. Request the SOC 2 report →
Network connectivity
Debit and regional network status is on the NetworkHub page. Lean integrates with the networks' dispute platforms; nothing here implies endorsement by a network.
Deployment
Institutions run AdjustmentHub on-premise, in AWS or Azure, or in a private cloud on OpenShift. Configuration is held in the deployment layer.
Data handling and the audit trail
Cardholder data is masked by default in the interface and on reports. Access is role-based and every action on every case is logged, so the audit record is produced by the workflow rather than assembled afterwards. Data is encrypted in transit and at rest, and system interfaces are authenticated.
Masking is a control, not a setting a client is asked to relax. Lean declines any request that would put cardholder numbers in the clear on a document that can be printed and copied, because no compensating control exists for that document. The reporting need behind the request is solved another way.
Regulation in the workflow
Regulation E and Regulation Z investigation windows, provisional credit timing and documentation requirements are configured into the workflow and instrumented against every case. Compliance with the regulation is the institution's; the platform gives it the clocks, the triggers and the audit trail to meet it. When a network changes its rules, Lean updates NetworkHub and AdjustmentHub.
Frequently asked questions
What security audits and certifications does Lean have?
Lean has a SOC 2 Type II report, issued July 2026. A SOC 2 report is an independent audit of controls, not a certification. Audit reports and certifications are listed on this page the week they are issued, with a note on what each one covers.
Does AdjustmentHub support Reg E and Reg Z?
Yes. Regulation E and Regulation Z timelines and documentation requirements are configured into the workflow and instrumented against every case.
How is cardholder data protected?
Masked by default in the interface and on reports, role-based access, a log of every action, encryption in transit and at rest, and authenticated interfaces, within the controls covered by Lean's SOC 2 Type II report.
Can I see the SOC 2 report?
Yes, under NDA. Ask a dispute specialist.