Security at LeadSignal

LeadSignal holds your leads' conversations, so how we protect them matters more than most SaaS. This page says plainly what we do today, what we are working towards, and how to reach us if you find a problem.

Where your data lives

• Hosting: the application and PostgreSQL database run on Render in the United States (Oregon). Database connections require TLS and credentials held only in Render's encrypted environment store. US hosting suits our mostly US customer base; UK and EU customers are covered by the transfer safeguards in our DPA.
• Files and media: uploaded images and documents are stored on Cloudflare R2 and served through Cloudflare's network.
• Backups: point-in-time recovery lets us recreate the database as it was at any moment in the past seven days, into a new instance that never overwrites production; we also take downloadable logical backups.

Encryption

• TLS 1.2 or higher on every connection — browser to app, app to database, app to every third-party API.
• Encryption at rest on the database and object storage, managed by the hosting providers.
• Connected-platform tokens (Meta, Google, Microsoft, LinkedIn) are stored encrypted and deleted the moment you disconnect.

Access and authentication

• Named user accounts with roles (admin, setter, viewer). No shared logins.
• Two-factor authentication for every user, and an account-wide "enforce 2FA" switch for admins.
• Sessions are revoked on password change; sign-in attempts are rate-limited and logged.
• Every record is scoped to your account; every query is filtered by it. No customer can see another's data.
• LeadSignal staff access to production is limited to named people with MFA, used only for support and operations, and reviewed quarterly.

Application security

• Inbound webhooks from Meta, Twilio, Stripe and the other platforms are verified by signature or shared secret before anything is processed.
• Outbound messages are rate-limited, logged, and — where the platform requires it — gated on consent per channel.
• Secrets live in the hosting provider's encrypted environment store, never in source control.
• Code is version-controlled, reviewed and deployed through an automated pipeline; dependencies are kept current.
• Card payments are handled entirely by Stripe; card numbers never touch our servers (PCI DSS SAQ A).

AI and your data

• Conversation text is sent to our AI provider only to score, summarise and draft for your account, under API terms that prohibit training on it.
• We never train general models on customer data, and never share one customer's conversations with another.
• You decide whether AI-drafted replies send on their own or wait for a person — and the AI never denies being an AI when a lead asks.

Privacy and compliance

• UK GDPR and EU GDPR: we act as your processor under our Data Processing Agreement, with a published sub-processor list and 30 days' notice of changes.
• International transfers are covered by the UK Addendum / EU Standard Contractual Clauses.
• Meta Platform Terms, Google API Services User Data Policy (Limited Use) and LinkedIn API terms are honoured for each connected platform — see the Privacy Policy.
• Roadmap: Cyber Essentials, then SOC 2 Type I. We will update this page when each is achieved rather than before.

Incident response

If a security incident affects your data we will tell you without undue delay and within 72 hours of becoming aware, with what happened, what data was involved, what we have done and what you should do. Status updates go to your account owner's email.

Reporting a vulnerability

Found something? Email security@lead-signal.ai with steps to reproduce. We acknowledge within two business days, keep you updated, and will not take legal action against good-faith research that avoids privacy violations, data destruction and service disruption. Our security.txt carries the same contact.