Security, backup and restore

HeyLead's API, database and tracking script run on Cloudflare, and the website and dashboard on Vercel. Both are large, independently audited providers. Payments are handled by Polar, so card data never reaches our systems.

• Encryption: all traffic uses HTTPS (TLS). The database, including its backups, is encrypted at rest with AES-256.
• Passwords are stored only as salted hashes, and API keys only as SHA-256 hashes. We can't see either.
• Sessions use secure, HttpOnly cookies. Signing out ends the session.
• Workspaces are isolated: every request is checked against the signed-in member's workspace and role (owner, admin, member, viewer).
• Site keys are locked to your domains: data sent with your key from any other domain is refused.
• Minimal data: IP addresses aren't stored, and the tracking script never reads password, card or file fields.

The HeyLead database is backed up continuously. Our database provider keeps a point-in-time history, so the whole database can be restored to any minute in the last 30 days.

Backups are managed by the provider and protected like the live database. Because history is kept for 30 days, data you delete, or that is deleted after a plan ends, is gone from backups within 30 days.

• If something goes wrong on our side (for example a faulty update or data corruption), we restore the database to the last good point and tell affected customers what happened.
• If you delete something by mistake, email us as soon as possible. Restores are made for the whole service, so we can't always bring back a single item you deleted, but we'll look at what's possible.
• Your own copy: you can export your leads as CSV at any time from the Leads page, and send every new lead to your CRM with webhooks or Zapier.

If we become aware of a security incident affecting your personal data, we will notify the workspace owner without undue delay, and within 72 hours where the law requires, with what we know and what we're doing about it.

Found a vulnerability? Please email hello@heylead.io with the details and don't access other customers' data. We'll acknowledge your report within two business days and keep you updated.