Security

Encryption in transit

All traffic to LeadClear is served over HTTPS/TLS. We enforce HTTP Strict Transport Security (HSTS) so browsers never fall back to an unencrypted connection once they've visited the site.

Password and credential handling

Passwords are hashed with bcrypt (cost factor 12) — we never store or have access to your plaintext password. OAuth tokens for connected integrations (Google Ads, Google Business Profile, Jobber, and other CRMs) are encrypted at rest.

Account isolation

Every piece of data in LeadClear — calls, contacts, spend, campaigns — is scoped to your specific business at the database query level. Invited team members can only ever see data belonging to the business they were invited to; billing, integration credentials, and team management stay restricted to the account owner.

Webhook and integration verification

Incoming webhooks from Twilio and Lemon Squeezy are cryptographically verified — we check an HMAC signature using a constant-time comparison before trusting any payload, which prevents both forged requests and timing-based signature-guessing attacks.

Application hardening

We set standard security headers on every response (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and run a Content-Security-Policy to limit what can execute in your browser session. Public, unauthenticated endpoints (like our tracking snippet) are rate limited per business to prevent abuse.

Infrastructure

LeadClear is hosted on Vercel with a managed Postgres database on Neon. Both providers maintain their own SOC 2 Type II compliance programs for the infrastructure layer.