Security

How we protect your data.

Your lead data is your business. We built LeadWiseSystem with the same security standards we use for our own internal tools. No shortcuts.

Infrastructure

AWS US-East-1 TLS 1.2+

Hosted on Amazon Web Services (AWS) — the same infrastructure used by Stripe, Netflix, and NASA
All data stored in US East region
All connections encrypted with TLS 1.2 or higher (HTTPS enforced)
Strict Transport Security (HSTS) headers on all responses
Separate database per product — your data is isolated from other systems

bcrypt JWT Rate Limited

Passwords hashed with bcrypt (industry standard, one-way hash — we cannot read your password)
Short-lived JWT tokens (24-hour expiry)
Login rate limited to 5 attempts per 15 minutes
Account lockout after repeated failed attempts
Role-based access control (Owner, Admin, Member, Viewer)

Input Validation CORS CSP

All API inputs validated with strict type checking (Pydantic schemas) — malformed requests are rejected before they reach business logic
Cross-Origin Resource Sharing (CORS) restricted to production domains only
Content Security Policy headers prevent XSS and injection attacks
X-Frame-Options prevents clickjacking
Request body size limited to 10MB (prevents DoS)
Bot/scanner path blocking (common attack vectors return 404 immediately)
Error messages sanitized in production — internal details never leak to users

Every query is scoped to your organization — you can never see another org's data
Organization ID enforced at the database query level on every request
Team members within your org have role-based permissions (viewers can't edit, members can't manage team)

Stripe PCI Compliant

You own your data. We store it to provide the service. We do not sell it, mine it, or share it.
Export your leads anytime as CSV — no lock-in
Request full account deletion and we permanently remove all data within 30 days

If you have security questions or want to report a vulnerability, contact us at matt@deneckemedia.co.