LeadVettr
Security

How we protect your leads.

LeadVettr handles consumers' personal details on your behalf. This page sets out, in plain terms, how that data is protected. Share it with your compliance team.

Encrypted in transit and at restHTTPS everywhere. Lead names, phones, emails, IPs, dates of birth and injury descriptions are encrypted with AES-256-GCM before they're stored.
Two-factor sign-inConfirm sign-ins with your device's PIN, fingerprint or face (passkeys), or an authenticator app. Required for every LeadVettr staff member.
Automatic data retentionPersonal details are cleared after 24 months by default, or sooner if you choose. Your verdicts and reports stay.
Your data stays yoursEach account is isolated. Staff access is role-based and every admin action is logged.

Encryption

  • All traffic to the app and API is served over HTTPS (TLS). Sign-in cookies are Secure, HttpOnly and SameSite=Lax.
  • Lead personal details (first and last name, phone, email, IP address, date of birth and injury description) are encrypted by the application with AES-256-GCM before they reach the database. The key is held outside the database, so a copy of the database on its own doesn't reveal them.
  • Duplicate and repeat-claimant checks still work because they compare keyed, one-way hashes (HMAC-SHA256) of phones, emails and name + date of birth, never the values themselves.
  • Webhook signing secrets and two-factor secrets are encrypted the same way.
  • API keys are shown once when created and stored only as SHA-256 hashes. Passwords are stored only as bcrypt hashes.

Sign-in and accounts

  • Passwords need at least 8 characters with upper- and lower-case letters and a number, and are checked against known data breaches.
  • The breach check uses the k-anonymity model of Have I Been Pwned: only the first 5 characters of a one-way hash of the password leave our servers, never the password.
  • After 5 failed sign-in attempts, that email is locked out for 15 minutes. Wrong two-factor codes count towards the same limit.
  • Optional two-factor sign-in with passkeys (your device's own screen-lock PIN, fingerprint or face via Windows Hello, Touch ID or your phone) or TOTP authenticator apps (Google Authenticator, 1Password, Authy, Microsoft Authenticator). For passkeys we store only a public key; the private key never leaves your device. Single-use recovery codes are stored as hashes. Turning two-factor on signs out your other devices.
  • Password-reset and invitation links are single-use, expire, and are stored as hashes. Resetting a password signs you out everywhere.
  • Sessions expire after 7 days of inactivity.

Access control

  • Every account's leads, sellers, keys and settings are separated, and every request is checked against the signed-in account or API key.
  • LeadVettr staff have role-based permissions, must use two-factor sign-in to open the admin console, and every admin action is written to an audit log.
  • Seller keys can only submit leads under their own seller name. They can't read your data or report outcomes.
  • API keys can be revoked at any time. Requests are rate-limited per plan.

Webhooks and email intake

  • Outgoing webhooks are signed with HMAC-SHA256 over a timestamp and the body (X-LeadVettr-Signature, X-LeadVettr-Timestamp) so you can verify they came from us.
  • Webhooks only go to public HTTPS addresses. Private, internal and loopback networks are refused when you save the URL and again before every delivery, and redirects aren't followed.
  • Each account's lead-intake email address is random and can be changed at any time.

Retention and deletion

  • Lead personal details are cleared automatically after 24 months. You can choose 3, 6, 12, 24, 36 or 60 months in Settings → Security. Scores, verdicts, sellers, outcomes and reports are kept, so your statistics stay intact.
  • Logs of lead-intake emails are removed on the same schedule.
  • You can delete all lead data, or your whole account, yourself in Settings at any time.

Payments

  • Card payments are handled by Stripe. Card numbers never reach LeadVettr's servers.

AI features

  • Back-test summaries are written by an AI model from totals only (counts, rates, seller names), not from individual leads.
  • If you forward a lead email that isn't in a simple "Label: value" layout, its text is sent to our AI provider to pick out the fields. Use the API or label-style emails to avoid this.
  • The in-app help assistant sees your questions and a summary of your account's settings and usage.

What we don't claim

LeadVettr is a young product. We don't yet hold a SOC 2 report or ISO 27001 certification. If your procurement process needs a security questionnaire, a data processing agreement or details beyond this page, contact us or email support@leadvettr.com.

Found a vulnerability? Please report it to support@leadvettr.com with "Security report" in the subject. We'll acknowledge it and keep you updated while we fix it.

Last updated September 2026. See also our Privacy Policy.

Try it on last month's leads first. It's free.

Create a free account