Security

You're connecting a form or a phone number to Lead Recorder, so it's reasonable to ask how the data is looked after. Here's the plain-English version — no SOC 2 report, just what's actually true today.

Encryption in transit

Every connection to Lead Recorder — the dashboard, the API, and the tracking script running on your customers' sites — is served over HTTPS/TLS. There's no unencrypted path for lead or account data to travel between a browser and our servers.

Encryption at rest

Sensitive fields are encrypted at rest before storage. OAuth refresh tokens for connected Google integrations, for example, are encrypted with AES-256-GCM and only ever decrypted in memory when needed to call a Google API on your behalf — see Google user data in our Privacy Policy for the full detail. Account passwords are never stored in plain text.

Where your data is hosted

Lead Recorder runs on Google Cloud Platform — the dashboard and leads database sit on Firebase (Firestore and Firebase Authentication), and the application itself is hosted on Vercel. Payments are handled by Stripe; we don't store your card details ourselves. We don't run our own on-premise servers, so your data benefits from the physical and network security those providers maintain.

Who has access

Access to your data inside Lead Recorder is role-based. Site owners (admins) see and manage everything on their own sites. Team members they invite can view leads across those sites but can't delete a site or manage billing. Clients an admin invites can only see the one site they've been given access to, and can't change lead status. Read-only client share links strip sensitive fields before anything is returned, and can be revoked by the admin at any time.

On our side, production data access is limited to the people who need it to build and support Lead Recorder — today, that's a small team, not a rotating cast of contractors. We don't sell or share your data with third parties, and we don't access your account data except to provide support you've asked for or to investigate a problem.

Backups

Your data lives on Google Cloud infrastructure, which stores it redundantly across multiple locations as standard. We're not going to overstate this with a specific retention window we can't stand behind — if you need details for your own due diligence, email us and we'll walk you through the current setup.

Reporting a security issue

Found a vulnerability? We'd genuinely rather hear about it from you first. Email hello@leadrecorder.com with what you found and we'll respond promptly.