For IT and security teams
IT, security, and data integrity
Technical details for allowing LRN360 access, reviewing its current safeguards, and understanding the next steps in its data-integrity roadmap.
Email and web access
Allowlisting checklist
Allow these verified LRN360 addresses and domains so users receive sign-in links, invitations, reminders, and report-ready notices.
- Application URL
- https://lrn360.leadersrising.network
- Email sender
- [email protected]
- Sender domain
- pathway.leadersrising.network
- Email delivery service
- Mailgun (via Lovable)
- Unsubscribe link host
- api.lovable.dev
- Reply and support
- [email protected]
Gateway guidance
- Allow the sender and sender domain.
- Permit links to the LRN360 application domain and to api.lovable.dev (the unsubscribe link in message footers).
- Allow by sender domain and DKIM signature (d=pathway.leadersrising.network). Sending IPs come from a shared pool and can change.
- Do not quarantine sign-in, invitation, reminder, or report-ready messages.
- Keep link-scanner rewriting compatible with normal HTTPS links.
Security gateways may inspect a sign-in message before delivery. LRN360 requires a deliberate user click before sign-in completes, so an automated inspection alone does not complete the sign-in flow.
The unsubscribe link in message footers opens a confirmation page; a link scanner opening it does not unsubscribe the recipient.
The application is served through Cloudflare. Need authentication-record evidence for a specific message? Send the headers of a quarantined message to [email protected].
Copy into an IT ticket
LRN360 access request
Please allow LRN360 email and web access for our organization. Application URL: https://lrn360.leadersrising.network Email sender: [email protected] Sender domain (DKIM d= and envelope): pathway.leadersrising.network Email delivery: Mailgun (via Lovable's email service); sending IPs are shared and can change, so please allow by sender domain and DKIM rather than IP Unsubscribe link host in message footers: api.lovable.dev Reply and support address: [email protected] Please allow messages from the sender and sender domain, permit links to the application URL and the unsubscribe host, and avoid quarantining LRN360 sign-in, invitation, reminder, and report-ready messages. If additional evidence is required, please contact [email protected] with the message headers from a quarantined email.
Current product controls
How LRN360 protects data integrity
These safeguards are implemented in LRN360 today. They are product controls, not a certification or a guarantee of complete security.
Role-based and row-level access rules separate leaders, coaches, administrators, and public visitors. Leaders and coaches cannot read rater links, draft answers, or individual responses.
No one sees a rater's answers with the rater's name attached. LRN administrators can see responses without names in order to produce the report; leaders and coaches see only combined results. Written comments are included only when at least three people have responded, and no scores are produced from fewer than two raters.
When a rater submits, their answers are saved and their name, email, and any draft answers are removed from the invitation in a single database transaction.
Rater links expire, accept only one submission, and stop working when replaced. When a report is generated or an administrator closes an assessment, all open links are retired, unsubmitted drafts are discarded, and rater names are removed from invitations. Contact details are kept separately, without any link to responses, so future rounds can be sent.
Leader and coach sign-in links use opaque references and do not place email addresses in URLs.
Report generation prevents overlapping runs from overwriting newer text and records status and failures.
Most administrative actions on reports, quotes, cohort pages, email, rater cycles, and account impersonation are recorded in audit logs.
A nightly integrity check looks for data that breaks these rules and reports it to administrators.
Email suppression, unsubscribe, bounce, and complaint handling prevents repeated sends to blocked recipients.
Directional roadmap
Planned data-integrity improvements
These are areas LRN360 intends to strengthen. They are directional, subject to change, and do not include delivery commitments or dates.
- 01Documented data-retention and deletion schedule
- 02Published backup, restore, and recovery objectives after the platform policy is verified
- 03Formal incident-response and customer-notification procedure
- 04Periodic access review and audit-log coverage review
- 05Export and deletion request workflow with supporting documentation
- 06Independent application security review appropriate to the product's use case
Hosted platform
Platform evidence from Lovable
LRN360 is hosted on Lovable Cloud, which uses Supabase's open-source foundation for database, authentication, and storage capabilities. LRN360's database is hosted in the United States (Lovable Cloud's Americas region, on AWS in Northern California). Pages are delivered through Cloudflare's network from the location nearest each visitor; for example, visitors near LRN's headquarters in Richmond, Virginia are served from Washington Dulles (IAD). Email is sent through Mailgun's European infrastructure via Lovable's email service, so invitation and reminder messages, including recipient names and email addresses, pass through the EU in transit.
Important scope distinction
Lovable's reports, certifications, policies, and agreements apply to Lovable as the platform provider. They are not certifications of LRN360 or Leaders Rising Network. LRN360 does not claim SOC 2, ISO 27001, GDPR, HIPAA, or PCI certification or compliance on the basis of Lovable's evidence.
What Lovable states
- Lovable Cloud hosts projects in a chosen region (Americas, Europe, or Asia Pacific), and project data is stored in that region. Lovable notes that the hosting region covers stored data, not where AI requests are processed.
- Lovable states that project secrets are stored securely and are usable only by the app.
- Lovable publishes privacy-law documentation, a DPA with stated plan eligibility, and a current subprocessor source.
- Current SOC 2, ISO, and other platform evidence should be reviewed in Lovable's live Trust Center rather than copied into a static page.
A Lovable per-app Trust Center, when enabled by the project owner, reports observed deployment facts. Lovable explicitly says that page is informational, not an audit or compliance certification.
AI processing
LRN360 uses AI models to draft report narrative text from rater responses and written comments. The report pipeline calls the Lovable AI gateway (ai.gateway.lovable.dev) using OpenAI's GPT-6 model family: gpt-6-luna classifies comments into themes and gpt-6-astra writes the report narrative. Rater responses are sent to these models without rater names or email addresses.
Questions or message review
Contact LRN360 support
Send IT and security questions, or the headers from a blocked message, to [email protected]. This page provides operational guidance and factual product and platform information. It is not legal advice, a security audit, or a contractual commitment.