Security
How LeadRilo approaches protecting your data — described honestly, without claiming certifications we have not earned.
The short version
- Data is encrypted in transit and hosted on reputable infrastructure.
- Access is authenticated and permission-scoped.
- We describe what we actually do — and clearly say what we do not yet claim.
This summary is for convenience only. The full text below is what governs.
1. Our Approach
Security is foundational to a platform that holds your leads and customer records. We build with least-privilege access, secure defaults, and reputable infrastructure, and we describe our practices honestly rather than with marketing badges.
2. Current Practices
- Encryption of data in transit using TLS
- Authentication and session management through a managed auth provider (Supabase Auth)
- Database access protected by row-level security and permission-scoped queries
- Administrative and internal endpoints protected by authorization checks
- Validation of inbound webhooks and rate limiting on public endpoints
- Secrets kept in environment configuration, not in client code
- Hosting and storage on established providers (Vercel, Supabase)
3. Your Role in Security
- Use a strong, unique password and keep credentials private
- Limit who has access to your workspace
- Only store data appropriate for the platform (see the Terms)
4. What We Do Not Claim
LeadRilo does not currently claim SOC 2, ISO 27001, HIPAA, or PCI DSS certification. We will only state a certification once it has been formally achieved. We also do not operate a paid bug-bounty program at this time.
5. Report a Security Concern
If you believe you have found a vulnerability or a security issue, please let us know so we can investigate. Please do not publicly disclose an issue before we have had a reasonable chance to respond, and do not access or modify data that is not yours.
Requests submitted here are recorded privately for our team and are not published or shown to other users.
Questions about this document? Email getLeadRilo@gmail.com. LeadRilo is governed by the laws of the United States and the state in which LeadRilo is established.
Related documents