Trust Center

This page is maintained by Leader AI and summarises the security, privacy, and operational controls currently in place at getleader.ai. It is owner-maintained content, not an independent audit or third-party certification.

• Sign-in: Email/password and Google OAuth.
• Tiered roles: super_admin, company_admin, marketing_manager, user.
• Data isolation: Row-Level Security enforced at the database for sensitive tables.
• Third-party tokens: Exposed only through safe views — never to the browser.

• Platform: Backend runs on Supabase (managed Postgres) on cloud infrastructure.
• In-transit encryption: All traffic secured with TLS.
• At-rest encryption: Database and object storage encrypted by the cloud provider.
• Backups: Automated daily backups with point-in-time restore.

• Account details: Name, email, phone — to provide the service.
• Business and lead data: Fields you enter to run your CRM.
• Communication content: Messages and files you upload so the agent can act.
• Technical usage: Operational logs for stability and debugging.

• API keys and secrets live in the platform secrets manager, never in source code.
• Server-side Edge Functions access secrets — browsers never receive them.
• OAuth tokens are stored in locked tables, readable only by the service role.

• Supabase — database, auth, and storage.
• Twilio — WhatsApp and SMS delivery.
• Resend — outbound email.
• Meta & Google — ads and calendar integrations (per user authorisation).
• CardCom — Israeli payment processing.

• Active account data is retained while the account is active; deleted up to 30 days after cancellation.
• You can request export, correction, or deletion any time via the Data Deletion page.
• Full detail in our Privacy Policy.