Your data, handled carefully.
The practices that protect your account, your clients and the people who visit your website.
Encrypted in transit
Every page, API call and tracking request is served over HTTPS with modern TLS, and browsers are told to always use it (HSTS).
Passwords and sessions
Passwords are hashed with scrypt and never stored or logged in plain text. Sign-ups must verify their email, and sign-in attempts are rate-limited.
Locked-down staff access
Our admin panel lives on a separate domain, requires two-factor authentication, is limited to approved IP addresses, and records every sensitive action in an audit log.
Built to resist abuse
Strict content security policy, bot protection on public forms, per-network rate limits, and website checks that refuse to reach private or internal addresses.
Minimal data by design
Our tracking snippet records form field names and a one-way hash of an email address, never the message or the address itself, and works without cookies.
Kept only as long as needed
Retention limits from our privacy policy are enforced by an automatic daily job, so old leads, logs and expired data are deleted on schedule.
Backups and recovery
The database is backed up daily to encrypted off-site storage, with a documented, regularly tested restore procedure.
Trustworthy email
All email is sent from our own authenticated domain (SPF, DKIM and DMARC), and every marketing-adjacent email has one-click unsubscribe.
Clear commitments
Our privacy policy, data processing agreement and subprocessor list spell out what we collect, why, and who helps us run the service.
Report a vulnerability
Found a security issue?
We welcome reports from security researchers and respond quickly.
Email security@getleadsfromai.com with a description, the steps to reproduce it and its impact. Please give us reasonable time to fix it before telling anyone else, and don't access other people's data, degrade the service or use social engineering.
We'll acknowledge your report within three business days and keep you updated until it's fixed.
Machine-readable contact details are in /.well-known/security.txt.