Where your data lives, and who can read it.

The database and the web app run in the US. Only the sending worker runs in Europe, in Amsterdam.

Database

PostgreSQL on Railway, in the US (us-west2)

Queues and background workers

Redis and workers on Railway

Web app

Vercel, with functions in the US (iad1)

Sending worker

Fly.io, in Amsterdam

Operator

BuildFlow, a sole proprietorship registered in Poland (EU)

Transfers to the US

Standard Contractual Clauses, as set out in the Privacy Policy

Scoped to your organisation

Every request checks who is signed in and which organisation they belong to, and reads or writes only that organisation's data. Every background job carries its organisation ID. A few scheduled system tasks, such as running saved searches and maintenance checks, look across all organisations to find work that is due.

Four roles

Owner, admin, member and viewer, checked on the server. A role covers every project in the organisation, and a viewer can read but not change anything. To keep two teams apart, give each its own organisation.

Mailbox passwords encrypted

SMTP and IMAP passwords are encrypted with AES-256-GCM before they are stored, using a key derived from a server secret.

Signed links

Unsubscribe, open and click links carry an HMAC-SHA256 signature, so they cannot be forged or guessed. Open and click tracking is off unless you switch it on for a campaign.

Sign-in

Handled by Google Firebase Authentication, with an email address and password or a Google account. The email address must be verified, and passwords are never stored in plain text.

• VercelHosts the website and the app. Functions run in the US (iad1).Receives: Everything you open or send in the app passes through it.
• RailwayHosts the database in the US (us-west2), the queues and the background workers.Receives: Everything stored in your account.
• Fly.ioRuns the sending worker, in Amsterdam.Receives: Campaign emails on their way to your mail server.
• Google Firebase AuthenticationSign-in, password reset and email verification.Receives: Your email address, a user ID and a password hash, never the password itself.
• ImprovMX (email relay)Relays account, security, support and lesson emails from myleadteam.com.Receives: The recipient's address and the message.
• AnthropicThe AI model for company research, drafting and reply labels.Receives: The working text for each task: website text of the companies you research, lead names and roles, your project details, knowledge extracts and replies.
• Voyage AIMakes your knowledge files searchable.Receives: The text of files you upload to Knowledge.
• Google PlacesFinds companies by kind of business and area.Receives: Your search terms and area.
• Bright DataOptional, when configured: extra search results for discovery, and fetching websites that refuse a plain request.Receives: Search terms and website addresses.
• SentryError monitoring for the app and the workers.Receives: Error reports from failed requests and jobs.
• StripePayments, once billing is switched on. Billing is off today.Receives: Billing details, when it is on.

When research looks up a company, its name or domain also goes to public lookup services: Google News (headlines), GitHub (public activity) and public DNS resolvers run by Google and Cloudflare, which also check your mailboxes' SPF, DKIM and DMARC. They receive a company name or a domain, not your account data or email content.

The same list as section 5 of the Privacy Policy.

• Every campaign email has a visible unsubscribe link and one-click unsubscribe headers (RFC 8058).
• An unsubscribe, an opt-out reply or a bounce, hard or soft, adds the address to your organisation's suppression list.
• The list is checked before every send in every project. It also blocks manual replies to that address.
• You can add addresses by hand or import a CSV.

Email support@myleadteam.com with “Security” in the subject. Describe what you found and how to reproduce it. Please don’t access other people’s data while testing.