Built to be trusted.

Leadflowly is run by an independent developer, not a faceless vendor — so security is handled deliberately rather than left to a team that assumes someone else owns it. The controls below are real and in the codebase today. Where something is planned rather than done, this page says so.

Security questions, or a procurement review? Email security@leadflowly.in.

• In transit. All traffic is served over HTTPS (TLS 1.2+). HTTP Strict Transport Security is enforced in production, and connections are upgraded to HTTPS automatically.
• At rest. The database is encrypted at rest by our infrastructure provider. On top of that, the most sensitive columns — Instagram, Messenger and WhatsApp access tokens, and OAuth credentials — are additionally encrypted at the application layer with AES-256-GCM, so a raw database read alone never exposes them.
• Passwords. Never stored in plain text — they are salted and hashed. One-time verification codes are hashed at rest too.

• Two-factor authentication. Time-based one-time-password (TOTP) 2FA is available on every account from Dashboard → Security, with single-use backup codes for recovery.
• Breached-password blocking. Every new or changed password is checked against the Have I Been Pwned breach corpus (via k-anonymity — your password never leaves our server).
• Verified email. Accounts must verify their email with a 6-digit code before first sign-in. Disposable email domains are rejected.
• Strong passwords + session hygiene. A minimum 12-character policy, httpOnly + Secure + SameSite session cookies, and server-side sessions that expire.
• Abuse protection. Authentication and other sensitive endpoints are rate-limited; signup is gated by reCAPTCHA.

• Role-based access. Workspaces have three roles — owner, admin and agent — and every capability is checked server-side from a single source of truth, so a permission can never drift between the UI and the API.
• Tenant isolation.Every record is scoped to a workspace; one customer's data is never reachable from another's session.
• Immutable audit log. Security-relevant actions — sign-ins, role changes, billing changes, exports and channel disconnections — are written to an append-only audit log that owners and admins can review from Dashboard → Security.

Leadflowly runs on managed, industry-standard infrastructure rather than self-hosted servers — patching, network security and physical security are handled by providers who specialise in it.

• Application & API. Hosted on Vercel, a SOC 2-compliant platform, with automatic TLS.
• Database. Managed PostgreSQL on Supabase (built on AWS), with encryption at rest and automated backups.
• Secrets. API keys and credentials are held as environment secrets, never committed to source control.

Today, customer data is stored in a single managed PostgreSQL region (our primary region). Dedicated EU and Indiadata regions are on the roadmap for customers with residency requirements (GDPR, India's DPDP) — the application is already structured so that a workspace carries its own region.

If your organisation needs data pinned to a specific region before that ships, contact security@leadflowly.in — we will tell you honestly where things stand.

• Backups. The database is backed up automatically by Supabase, enabling point-in-time recovery.
• Status & uptime. Live component health and a 90-day uptime history are public at leadflowly.in/status, and a machine-readable feed is at /api/status.

You own the conversation flows you build and the leads you capture. We do not sell your data or use it to train AI models. The Privacy Policy is the full account of what we collect and why; account and lead deletion is covered on the Data Deletion page.

Leadflowly relies on a small set of vetted providers to deliver the service. Each processes only the data needed for its function:

• Vercel— application & API hosting.
• Supabase — managed PostgreSQL database.
• Stripe — subscription billing (card data is handled entirely by Stripe; we never see it).
• Resend — transactional email delivery.
• Meta Platforms — the Instagram, Messenger and WhatsApp messaging APIs.
• Google — OAuth and Google Sheets export, when you connect them.
• Groq, Google Gemini & Anthropic — the AI providers behind reply suggestions and lead intelligence.

When you connect a CRM, we send the leads you have captured to it on your instruction. Those providers receive that data because you asked us to send it, not because we chose them:

• HubSpot, Zoho & Pipedrive — the CRMs we sync contacts and deals with, when you connect one.
• Google Sheets — lead export, when you enable it.

Occasionally a public authority asks a company to hand over user data. We would rather tell you how we handle that before it happens than after. Four commitments apply to every such request, whatever its source:

• We check that it is lawful. Every request is reviewed against the law of the jurisdiction it comes from before anything is disclosed. We require valid legal process — a warrant, court order, or an equivalent binding instrument. An informal request from an official, without legal process behind it, is refused.
• We push back on requests we believe are unlawful. If a request is overbroad, defective, or conflicts with the law we operate under, we challenge or reject it and take legal advice where the stakes warrant it.
• We disclose the minimum. Where disclosure is legally required, we produce only the specific records the instrument actually compels — never a whole account, and never a bulk export, because a request named one person.
• We write it down. Every request, our legal reasoning, who was involved, and exactly what was disclosed is recorded and retained.

Where we are legally permitted to do so, we will notify the affected customer before disclosing their data, so they have the opportunity to seek their own remedy.

To date we have never received a request of this kind. If that changes, this page changes with it.

Leadflowly is built toward the SOC 2 control set — audit logging, access control, encryption and change management are all in place — but is not yet SOC 2 certified; a formal audit is planned as the company matures. We would rather state this plainly than imply a certification we do not hold.

Our data handling is aligned with the GDPR and India's DPDP Act. A Data Processing Agreement is available on request for customers who need one.

If you believe you have found a security vulnerability, please report it to security@leadflowly.in before disclosing it publicly. We will acknowledge your report, keep you updated, and will not pursue action against good-faith research that respects our users' privacy and avoids service disruption.

Machine-readable contact details are published at /.well-known/security.txt per RFC 9116.