LeadTale is built for businesses that move fast but can’t compromise on how customer and prospect data is handled. Here’s how we protect it — end to end.
Security isn’t a feature — it’s a practice we build around every layer of the platform. These are the controls that protect your data today.
The LeadTale platform runs on Google Cloud Platform in hardened, multi-zone regions. Our marketing site runs on Vercel. Databases are hosted on MongoDB Atlas with network isolation and at-rest encryption. We rely on providers with SOC 2 Type II and ISO 27001 attestations.
All data is encrypted in transit over TLS 1.2+ and at rest using AES-256. Secrets are stored in a centralized secret manager, never in source control, and rotated on a regular schedule.
Access to production systems follows least-privilege principles, is restricted to a small on-call group, and requires single sign-on with mandatory multi-factor authentication. All production actions are audit-logged.
Every change is reviewed, tested, and run through automated checks — lint, type-check, unit and integration tests, dependency scanning, and secret scanning — before it reaches production. High-risk surfaces (auth, billing, data access) receive additional adversarial review.
Automated backups, infrastructure-as-code deployments, health monitoring, error tracking, and alerting keep the platform observable. Incident response runbooks cover detection, triage, communication, and remediation — with post-incident reviews for every significant event.
Team members sign confidentiality agreements and receive security training. Production data access is granted on a need-to-know basis and revoked promptly when roles change. Workstations require disk encryption, screen lock, and managed endpoint protection.
Structured audit logs, uptime monitoring, and anomaly detection run continuously. Unusual authentication, export, or data-access patterns trigger alerts to the on-call team.
Customer data is isolated per tenant and never used for cross-customer purposes. We do not sell personal information. On termination, customer data is returned or deleted in accordance with our Terms of Service and Data Processing Addendum.
LeadTale supports obligations under GDPR, UK GDPR, CCPA/CPRA, and other US state privacy laws. Our Data Processing Addendum is available on request and we sign it for enterprise customers who require one.
LeadTale is designed to support your obligations under major privacy regimes — from EU and UK GDPR to the California Privacy Rights Act and other US state laws. Our Data Processing Addendum is pre-signed and incorporated by reference into our Terms.
We appreciate security researchers who report responsibly. Email us and we’ll acknowledge within two business days, triage, and keep you updated through remediation.