Security overview
How we protect your business and your customers’ data.
Described plainly: what we do today, without badges or certifications we don’t hold. If you need more detail for a security review, ask us.
| In transit | TLS (HTTPS) |
|---|---|
| Credentials at rest | AES-256 |
| Passwords | bcrypt hashes |
| People | Six roles, page locks, audit log |
| Meta webhooks | Signature required |
01
Encryption
Data in transit is protected with TLS — the website and the app are served over HTTPS. Sensitive credentials are encrypted at rest with AES-256.
In practice
- WhatsApp, Instagram and Facebook access tokens, email passwords and your own AI key are stored encrypted
- Encrypted credentials are never sent back to the browser — settings only show whether one is saved
02
Authentication
Passwords are hashed with bcrypt before they are stored. Signed-in sessions use signed tokens that expire.
In practice
- We never store passwords in readable form
- Sign-in attempts are rate-limited
03
Access control
Six built-in roles — Owner, Admin, Manager, Sales Agent, Support and Viewer — decide who can see and change what. Owners can also lock individual pages per role.
In practice
- Salespeople can be limited to their own leads in views such as Leak Radar
- Security and admin activity is recorded in an audit log with who did it and when
04
Workspace isolation
Each business is a separate workspace. Leads, conversations, settings and files are stored and queried per workspace, so your team works only with your own business’s data.
In practice
- Diagnostic and webhook tools only show your own workspace’s records
05
Inbound webhooks
Messages and events from Meta are accepted only with a valid X-Hub-Signature-256. Requests with a missing or wrong signature are refused, not processed.
In practice
- Workflow webhook secrets are compared in constant time
- Credential headers are removed before webhook payloads are logged
06
Responsible disclosure
Report vulnerabilities to security@leadforgrow.com. We aim to respond within 72 hours.
In practice
- Our responsible disclosure policy describes scope and safe harbour for researchers
Related documents
Security questions or a questionnaire to fill in? Send it to us and we’ll answer it honestly — including what we don’t do yet.