Security & Data Protection
A plain-language summary of measures currently implemented.
Authentication
Partner passwords are stored only as salted scrypt hashes — never as plain text. Sessions use httpOnly, SameSite cookies with a limited lifetime; when a server secret is configured, session cookies are additionally HMAC-signed so they cannot be forged.
Role-based permissions
Access to admin and partner areas is enforced server-side on every protected route and action. Partner accounts are only active after manual administrator approval and invitation; a role value from the browser is never trusted on its own.
Restricted admin access
Partner applications, lead records, evaluation notes, and admin settings are readable only by authenticated administrators. Partners see only the leads assigned to them and their own sales data.
Data access limitations
Records are scoped to the authenticated role: partners cannot browse the full CRM, export lead databases, or view other partners' records. Admin-only pages are never linked from the public website.
Secure communication and forms
Public forms validate input server-side, use a honeypot field, and apply per-device rate limits to reduce spam. In production the site should be served over HTTPS; this is verified at deployment.
Incident reporting
If you believe you have found a security issue or a data exposure, report it to hello@leadcora.online. We ask that you do not publicly disclose vulnerabilities before we have a chance to address them.
We do not claim SOC 2, ISO 27001, penetration-test certification, or encryption guarantees. This page documents only what is implemented today.