Security at LeadVector.
How LeadVector protects your account, your connected mailboxes, and the data you work with. This page lists only what we do today, and no certification we have not earned.
Your mailboxes
OAuth, never passwords
Google Workspace and Microsoft 365 mailboxes connect through OAuth. LeadVector never asks for, or stores, a mailbox password.
Encrypted access tokens
The OAuth tokens that let LeadVector send and sync mail are encrypted at rest with AES-256-GCM.
Deleted on disconnect
Disconnecting a mailbox deletes its tokens. Deleting a mailbox removes its synced messages and warmup records.
Your account and API
Passwordless sign-in
Sign in with a one-time code sent to your email, or with Google or Apple. There is no LeadVector password to leak or reuse.
Hashed API keys
API keys are stored only as a SHA-256 hash and shown in full once, when you create them. Revoke a key at any time.
Team permissions
The workspace owner decides, person by person, who can manage CRM settings, billing, and the team.
Your data
Hosted in the EU
Customer data is stored and processed in the European Union, with Standard Contractual Clauses for any transfer outside it.
GDPR and CCPA
Every user has GDPR rights of access, correction, and deletion, California residents have CCPA rights, and a Data Processing Agreement is available on request.
Deletion when you leave
Close your account and your data is deleted or anonymised within 30 days. Export it first if you need it.
Questions
Common questions about security and data protection.
Is LeadVector SOC 2 or ISO 27001 certified?
Not today. LeadVector does not hold SOC 2 or ISO 27001 certification. We run regular code audits, with security review as part of every audit. If your security review needs more detail, contact us: we will answer your questionnaire and share our Data Processing Agreement.
Which third parties process my data?
Data and verification providers receive only the inputs of a lookup, such as a name and a domain, an email address, or a profile URL. LeadVector AI requests go to OpenAI and Anthropic under agreements that do not allow training on your data. Payments, email delivery, hosting, and error monitoring use established providers, and the privacy policy lists each category.
How do I report a security issue?
Email privacy@leadvector.app with the details and steps to reproduce. We will confirm receipt and keep you updated until it is resolved.