Security

Hosting and infrastructure

• Web app (app.staffingleads.com): hosted on Vercel.
• API and background worker: a dedicated Linux server behind nginx, accepting HTTPS only.
• Database: Neon managed PostgreSQL on AWS, region us-east-2 (Ohio, United States). Neon encrypts stored data with AES-256, enforces TLS 1.2+ in transit, and undergoes annual SOC 2 Type II and ISO/IEC 27001 audits (Neon security). We take a backup before every database change.
• All traffic between browsers, our servers and our providers is encrypted in transit (TLS/HTTPS).

Accounts and sign-in

• Passwords are never stored in plain text: they are hashed with bcrypt (cost factor 12).
• Email sign-in links are single-use and expire after 15 minutes.
• Sign in with Google uses Google’s verified sign-in. We receive only the user’s name and verified email address.
• Phone sign-in codes are sent and checked by Twilio Verify.
• Sessions can be revoked: a security event, such as the owner of an inbox reclaiming an account, signs out every earlier session.
• New accounts require a work email address.

Connected email and LinkedIn accounts

Users connect LinkedIn, Gmail or Outlook / Microsoft 365 so their campaigns send from their own accounts. These connections run through Unipile, which is SOC 2 Type II certified, GDPR compliant, CASA Tier II certified, and hosts data exclusively in France (EU).

• Tokens stay with Unipile. Microsoft and Google sign-in tokens are held by Unipile and are never stored in StaffingLeads’ database.
• We only send what the user sets up. StaffingLeads sends the emails and messages the user configures in their campaigns, from their own account.
• We keep only campaign conversations. We store replies from the user’s campaign contacts and the messages we send for them. We never read or import other mail or mailbox history, and we never delete, move or edit messages in the user’s mailbox.
• Access can be removed at any time. Users can disconnect an account in StaffingLeads, which removes the connection at Unipile. Microsoft 365 and Google Workspace administrators can also revoke access from their admin console.

Payments

Payments use Stripe Checkout. Card details go directly to Stripe and never reach StaffingLeads’ servers; we store only the Stripe customer and subscription IDs.

Internal access

• Access to production data is limited to the core team.
• The internal admin portal is password protected.
• When support views an account as the customer to help them, the session is read-only by default and every such session is recorded in an audit log.

AI

StaffingLeads uses OpenAI to draft outreach messages and to classify replies (for example interested, referral, or out of office). Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models.

Subprocessors

Providers that process data to run StaffingLeads:

Data requests and security questions

Customers can ask us to export or delete their data, including stored campaign replies. For data requests, or questions from your IT or security team, email privacy@staffingleads.com. See also our Privacy Policy and Terms of Service.