Security
Your leads are your revenue. We treat them that way.
LeadMove processes personal data on your behalf — so here is exactly how it is protected, where it lives, and how you get it back out. No badges we don't hold, no claims we can't back.
Encryption everywhere
All traffic is encrypted in transit with TLS. Lead data is encrypted at rest (AES-256) in our database. Passwords are hashed — never stored in plain text.
Transparent hosting
Our database runs on Supabase and the application on Vercel, both in US regions. The full sub-processor list, with hosting regions, is public in our Privacy Policy — no surprises about where your data lives.
GDPR: you control, we process
For the leads you route, you are the Data Controller and LeadMove acts as your Data Processor. EU data transfers are covered by Standard Contractual Clauses with our sub-processors, and a Data Processing Agreement is available on request at hello@leadmove.io.
Delivery you can audit
Every delivery attempt is logged lead-by-lead: which buyer, which endpoint, when, the exact payload we sent, and the response we got back. Failed webhooks retry with exponential backoff behind a circuit breaker — and every retry is in the log too.
A record of who changed what
Configuration changes are logged as an audit trail: who touched which pipeline, buyer or routing rule, when, and the value before and after. Timestamps are shown in your organization’s own timezone, and the trail is kept for two years.
Your data is portable
Export your leads as CSV or via API at any time. If you cancel, email us and we will send you a full export of your data. Deleting your account deletes your data within 30 days, except where law requires retention.
Access control
Your organization’s data is isolated per tenant. Buyers only ever see their own leads through the buyer portal — never other buyers’, never other pipelines’.
Keys and sessions you control
Each pipeline has its own API key, revocable and regenerable at any time, and inbound endpoints are rate-limited. Changing a buyer’s portal password ends every other session they had open, on the spot.
Assistants
What Claude or ChatGPT can do in your workspace, and what they never can.
You can connect the assistant you already use to your LeadMove account and work in it from there. It has the permissions of your own role, nothing changes without a preview and your yes, and everything undoes for seven days.
What they can do, and what they can never do
Claude, ChatGPT, Claude Code or any MCP client connected to your workspace can read it, propose configuration changes, act on leads and record buyer payments, each behind a permission you tick on purpose. A change is a preview first: nothing is applied until you approve it, and every applied change can be undone for seven days. No permission, role or request lets an assistant charge a card, refund one, delete a record, read or create a credential, or reach another organization. Text found in your data, a lead comment, a buyer error, a dispute note, is reported on and never followed as an instruction.
Permissions follow the role
Four permissions, each with a minimum role: reading needs a member, changing configuration and acting on leads need an admin, recording a payment needs an owner. A connection can never do what the person behind it could not do by hand. The role is re-read on every request, so a demotion narrows an existing connection at once and someone leaving the workspace suspends theirs. Permissions can be removed from a connection, never added: adding one means connecting again, a dated and named event.
Revocation in one click
Settings, Developers, Assistant access holds one switch per permission covering every connection at once, which is the fastest stop. Below that, each connection can be suspended, revoked for good, or trimmed to fewer permissions. The token behind a preview is worth nothing on its own: it expires after ten minutes, works once, and is refused if someone edited the same thing in between. A connection also has ceilings, 120 requests a minute and 200 changes a day, and reading is never affected by them.
Everything is on the record
Every change made through an assistant lands in the same two-year audit trail as a change made by hand, under the name of the connection, with the values before and after. Each connection shows its own recent calls: the tool used, whether it worked, how long it took, and never the values it carried. Moving where a buyer receives leads emails every owner the moment it happens, with the diff and an undo link.
The full list of permissions, limits and ways to switch it off is in what a connected assistant can and cannot do, and what leaves your account is in data sent to a connected assistant.
Where to look deeper
- Privacy Policy — including the full public list of sub-processors and their hosting regions.
- Webhook documentation — how lead ingestion and delivery work, including authentication and retries.
- hello@leadmove.io — for a Data Processing Agreement, security questions, or responsible disclosure of a vulnerability. Security reports are read the same day.