A security page that starts with what is missing.
You are about to connect a production mailbox and upload a client list. This page states where that data is stored, how one organisation is kept apart from another, who else processes it, and which assurances do not exist yet.
No payment method. No recurring charge. Your own SMTP, your own data.
- Tenant scope
- Every query filters by organisation
- Mailbox credentials
- AES-256-GCM at rest
- Operator
- BuildFlow, Poland (EU)
- Certifications
- None
Every system that holds a copy
Eight rows, named. If a system is not on this list, MyLeadTeam does not put your data there. The operating entity is in the EU; a contractual region pin for the hosting providers is not something the platform offers yet.
- Primary database
- PostgreSQL on Railway
- Queues and rate limiting
- Redis on Railway
- Knowledge base and embeddings
- JSONB in the same Postgres
- Web application
- Vercel
- Agent workers
- Railway
- Sending worker
- Fly.io
- Error monitoring
- Sentry
- Operating entity
- BuildFlow, Poland (EU)
One organisation cannot read another one's row.
Isolation here is a query-level rule rather than a setting somebody can switch off. It is enforced in the web application and again in the workers, because the background job is where scoping is usually forgotten.
Every query is scoped
Each database read and write filters by organizationId. There is no trusted internal path that skips the filter, and no privileged call that is allowed to ignore it.
The schema enforces it too
organizationId columns are NOT NULL, carry foreign keys with ON DELETE CASCADE, and have their own indexes. A row without an owning organisation cannot be written in the first place.
Background jobs carry the scope
Every BullMQ job payload includes the organizationId. Isolation therefore still applies once the work leaves the web request and runs inside a worker, which is where scoping is usually forgotten.
Sending stays inside the project
A campaign can only start from email accounts in the same organisation and the same project. Switching organisation invalidates the entire query cache, so nothing from the previous client survives the switch.
Four checks between a stranger and your client list.
Authentication, role, resource ownership, then transport. Each check is separate, and an API endpoint never inherits its answer from the page that called it.
- 01
Sign in
Auth.js v5 with JWT sessions. Passwords are hashed with bcrypt. A legacy SHA-256 hash still verifies once and is rehashed to bcrypt during that login, so no account keeps the older hash after its next sign-in.
- 02
Carry a role
Role-based access control with four roles: owner, admin, member, viewer. Owner and admin manage the team, member can create and edit, viewer is read-only. The role is checked on the server, not by hiding a button in the interface.
- 03
Prove ownership per request
Middleware redirects anyone who is not signed in. Each API endpoint then runs its own authorisation helper and verifies that the requested project, campaign, lead or mailbox belongs to the caller's organisation. Invitations and password resets use tokens that expire, and sensitive endpoints are rate limited with a Redis sliding window.
- 04
Protect secrets and links
SMTP passwords are encrypted with AES-256-GCM using a key derived from AUTH_SECRET before they reach the database. Tracking URLs are signed with HMAC-SHA256, so an open or click link cannot be forged or enumerated. next.config.js sets a content security policy, HSTS, COOP, CORP and a Permissions-Policy header. The production dependency audit reports no known vulnerabilities.
Nine third parties, named in full.
A sub-processor is anyone who can see your data because MyLeadTeam sends it to them. This is the entire list, with the role each one plays.
- Anthropic
- AI analysis and drafting
- Google Places
- Business discovery
- Voyage AI
- Knowledge base embeddings
- Railway
- Database and agent workers
- Vercel
- Web application hosting
- Fly.io
- Sending worker
- Sentry
- Error monitoring
- Bright Data
- Optional scraping fallback
- SMTP platform provider
- Product system email
What each of them receives is described in the privacy notice, and the contractual position is in the terms of service. Both documents state what is in place today, and both are waiting for a Polish and EU legal review.
What we do not have
MyLeadTeam is in a controlled, invitation-only early phase, which makes this the right moment to ask about these things rather than the moment they are already finished. Everything below is absent today, and the privacy notice and the terms of service describe the current position rather than a finished one. Nothing on this page is legal advice.
No SOC 2 and no ISO 27001
Neither certification exists and neither audit is under way. If your procurement process requires one of those reports, MyLeadTeam does not pass it today.
No penetration test report
The application has not been tested by an external offensive security team, so there is no report to send you and no remediation log to review.
No SSO and no SAML
Sign-in is email and password with a JWT session. There is no identity provider integration, so accounts are provisioned and removed by hand.
No DPA as a ready document
There is no signed data processing agreement waiting in a drawer. The privacy notice and the terms of service state the current position, and both are waiting for a Polish and EU legal review. Your lawful basis for contacting recipients stays yours.
No SLA and no status page
Uptime is not contractually guaranteed and there is no public status page to check during an incident. You would find out from us, or from the product.
No independent security audit
Everything on this page is a description of the codebase written by the people who wrote the codebase. No outside party has verified any of it.
Six questions before you connect a mailbox.
Get started
Ask the question this page does not answer.
Early access is invitation-only, and the quickest way to test any claim here is to ask about the part that matters to you. Bring your procurement list.
No payment method or recurring charge during early access.