Security

How we protect your data.

Your lead data is your business. We built LeadWiseSystem with the same security standards we use for our own internal tools. No shortcuts.

Infrastructure

AWS US-East-1 TLS 1.2+
  • Hosted on Amazon Web Services (AWS) — the same infrastructure used by Stripe, Netflix, and NASA
  • All data stored in US East region
  • All connections encrypted with TLS 1.2 or higher (HTTPS enforced)
  • Strict Transport Security (HSTS) headers on all responses
  • Separate database per product — your data is isolated from other systems

Authentication

bcrypt JWT Rate Limited
  • Passwords hashed with bcrypt (industry standard, one-way hash — we cannot read your password)
  • Short-lived JWT tokens (24-hour expiry)
  • Login rate limited to 5 attempts per 15 minutes
  • Account lockout after repeated failed attempts
  • Role-based access control (Owner, Admin, Member, Viewer)

Application Security

Input Validation CORS CSP
  • All API inputs validated with strict type checking (Pydantic schemas) — malformed requests are rejected before they reach business logic
  • Cross-Origin Resource Sharing (CORS) restricted to production domains only
  • Content Security Policy headers prevent XSS and injection attacks
  • X-Frame-Options prevents clickjacking
  • Request body size limited to 10MB (prevents DoS)
  • Bot/scanner path blocking (common attack vectors return 404 immediately)
  • Error messages sanitized in production — internal details never leak to users

Data Isolation (Multi-Tenant)

  • Every query is scoped to your organization — you can never see another org's data
  • Organization ID enforced at the database query level on every request
  • Team members within your org have role-based permissions (viewers can't edit, members can't manage team)

Payments

Stripe PCI Compliant
  • All payments processed by Stripe (PCI DSS Level 1 certified)
  • We never see, store, or process credit card numbers
  • Webhook signatures verified on every payment event

Data Ownership

  • You own your data. We store it to provide the service. We do not sell it, mine it, or share it.
  • Export your leads anytime as CSV — no lock-in
  • Request full account deletion and we permanently remove all data within 30 days

Operational Security

  • Secrets stored in AWS Secrets Manager (not in code or environment variables)
  • Admin access restricted to named individuals
  • All API access logged with CloudWatch
  • Automated monitoring and alerting for errors

Questions?

If you have security questions or want to report a vulnerability, contact us at matt@deneckemedia.co.

← Back to LeadWiseSystem