Security and data handling

This page describes how Leadraft protects your account and the data we handle. It is a plain description of what we do today, not a certification. If your security team needs more, email support@leadraft.co.

Your account#

• Single sign-on and two-factor authentication. Sign in with Google, Microsoft or your company's identity provider through our authentication partner, WorkOS. Owners can require two-factor authentication for everyone in the organization.
• Roles. Owners, admins and members see and do different things. Invite and remove teammates from settings.
• Sessions. See where you're signed in and sign out other sessions.
• API keys are scoped, shown once, stored hashed, and can be revoked at any time.

Data in transit and at rest#

• Everything between your browser, our API and our servers travels over TLS (HTTPS).
• Credentials you give us for destinations such as Instantly, HubSpot or Smartlead are encrypted at rest, and are used only to push the data you choose.
• Webhooks we send are signed, so you can check they came from us.
• Card details never reach our servers: payments are handled by Stripe.

How we check an email without emailing anyone#

Verification uses the same first step every mail server uses to accept a message, and then stops:

1. We look up the domain's mail servers (its MX records).
2. We open a connection and ask whether the mailbox exists (RCPT TO).
3. We hang up before any message is sent.

No email ever reaches the person, and nothing appears in their inbox. Read more in how verification works.

Suppression and opt-outs#

• Global opt-outs. When a business or person asks to be removed through our opt-out page, they stop being delivered to every customer.
• Your do-not-contact list. Upload emails or domains, and Leadraft leaves them out of every export and push automatically.
• Bounce feedback. When you send through Instantly, bounced addresses feed back into your suppression list.

Your data, under your control#

• Export your organization's data from settings at any time.
• Delete your organization and its data from settings. See our Privacy Policy for retention.
• Searches and exports belong to your organization. Other customers can't see what you search for.

Infrastructure#

• The service runs on dedicated servers with daily database backups and access limited to the people who operate it [to confirm: hosting provider and region].
• Errors are monitored so we hear about problems before you do.
• Our providers are listed in the Privacy Policy.

Reporting a vulnerability#

Found a security issue? Please email support@leadraft.co with details, and give us a reasonable chance to fix it before telling anyone else. We'll reply quickly and keep you updated.