Information Security

Leads 2 Build (“we,” “us”) runs a written information security program for the Leads 2 Build platform (the “Service”). It is led by our owner, who is also our information security lead, and set out in written policies that every member of our team must read and acknowledge. The policies cover access control, two-step sign-in, encryption, secure development, change management, vulnerability management, logging and monitoring, incident response, backups and continuity, vendor management, data classification, retention and privacy.

SOC 2. We are preparing for a SOC 2 examination covering all five Trust Services categories — security, availability, processing integrity, confidentiality and privacy. We do not yet hold a report. We do not hold ISO/IEC 27001 or any other security certification, and when that changes this page will say so, with the date.

• Hosting — the Service runs on Vercel, with its database on Supabase and files on Cloudflare. Each holds independent SOC 2 reports and is responsible for the physical security of its data centres. All three process data in the United States. The full list of vendors is on our subprocessors page.
• Encryption in transit — all traffic between your browser and the Service uses TLS, and browsers are told to use HTTPS only (HTTP Strict Transport Security).
• Encryption at rest — our database and file-storage providers encrypt stored data. On top of that, the credentials you give us to connect other services (accounting, calendar and advertising tokens, CRM and estimating-software logins) are encrypted by the application with AES-256-GCM using a managed master key, so they are never stored in readable form.
• Separation between accounts — every record carries the identifier of the account it belongs to, and every read and write is scoped to your account on our servers. Our database is not reachable directly from browsers.
• Sign-in — sign-in is handled by Clerk; your password never reaches our servers. Two-step sign-in is required for every Leads 2 Build staff account (enforced in the app from November 7, 2026). Each customer account has a setting that requires two-step sign-in for its owners and admins, turned on for new accounts. Refunds, payouts and credits ask for a fresh verification before they go through.
• Access — what each person can see and do in the Service depends on their role. Our own staff are given only the access their job needs. Removing someone ends their active sessions immediately. Access is reviewed every quarter, and each review is recorded with a tamper-evident snapshot of who had access at the time.
• Logging — changes to your records are written to an audit log that cannot be edited, kept for at least 13 months. When a member of our staff opens a customer account to help with it, that is recorded in a separate log that also cannot be edited.
• Files and shared links — photos, documents and call recordings are stored privately and opened through short-lived signed links; images your customers add through their portal are stored under long random addresses. Links you send to customers, crews or lenders use long random codes, and customer portal links stop working when they expire.
• Payments — card and bank details are collected and held by Stripe. We never store full card numbers.

No method of transmission or storage is perfectly secure. We apply the safeguards on this page, but we cannot guarantee absolute security.

• Every change is tracked — each change to the Service is tied to a ticket and must pass automated checks before it can go live, including type checking; a release that fails them does not deploy. A check that every database query is scoped to one account runs before changes are pushed, and every change is also scanned for known-vulnerable dependencies and accidentally committed secrets. Any release can be rolled back in seconds.
• Vulnerability fixes on a deadline — we receive automated alerts and update proposals for vulnerable dependencies. Fixes are due within 7 days for critical issues, 30 days for high and 90 days for medium.
• Monitoring — server errors, failed scheduled jobs and the health of the Service are monitored, and alerts go to our security lead. Public endpoints are rate-limited.
• Backups — our database provider takes a backup every day and keeps it for 7 days.
• Our team — everyone with access to customer data must acknowledge our security, confidentiality and acceptable-use policies, and must use two-step sign-in (enforced from November 7, 2026).

We have a written incident response procedure covering how we recognise, contain, fix and learn from security incidents. If we confirm a breach affecting data in your account, we will notify your account owner without undue delay and no later than 72 hours after we confirm it, and tell you what happened, what data was involved and what we are doing about it. We notify partners (including Intuit where QuickBooks data is involved) and regulators as the law and our agreements require. Our Data Processing Addendum sets out these commitments in full, and our Privacy Policy explains how we handle personal information.

We welcome reports from security researchers and customers. If you believe you have found a vulnerability in the Service, email security@leads2build.com with enough detail for us to reproduce it. We acknowledge reports within 3 business days and keep you updated until the issue is resolved. Our contact details are also published in machine-readable form at /.well-known/security.txt.

When you test, please:

• use only accounts you own, and never access, change or delete another customer’s data;
• avoid anything that degrades the Service for others, such as load testing or spam;
• do not use social engineering or physical attacks against our team or our vendors;
• give us a reasonable time to fix the issue before you disclose it publicly.

Customers and partners who need more detail for a vendor security questionnaire can request it from security@leads2build.com.

To report abuse rather than a vulnerability — spam, harassment, or any message sent through the platform that should not have reached you — write to abuse@leads2build.com. Recipients of a text message can also reply STOP at any time to opt out immediately. Every other way to reach us is listed on our support and contact page.