Built for enterprise lead distribution
Lead Distro AI routes leads and calls for agencies, brokers, and buyers in regulated verticals such as insurance, mortgage, solar, and legal. Our security program is built for the sensitivity and compliance requirements of that data.
Last updated: October 18, 2026
Six layers of protection
Every lead record is protected by the same controls enterprise buyers expect from any SaaS platform handling regulated data.
Encrypted at every layer
TLS 1.2+ in transit. Database encrypted at rest by Supabase. Integration tokens (Meta, Google, Microsoft, GoHighLevel) also encrypted with AES-256-GCM, with keys kept outside the database.
Role-based access control
Organization-based team roles through Clerk, a SOC 2 audited identity provider, with multi-factor sign-in available on every account.
Audit trails
Every lead keeps a delivery trail of which buyer received it and when. Staff support logins and every AI assistant tool call are logged.
Tenant isolation
Every customer record is scoped by organization ID in the application. Row-level security is switched on for every table as a second safeguard.
72-hour breach notice
Our Data Processing Addendum commits us to notify customers within 72 hours of becoming aware of a personal data breach.
Managed backups
Database backups are managed by Supabase. Backups roll off on a 90-day rotation, as our DPA states.
Compliance & regulations
Lead distribution runs into more regulations than almost any other SaaS category. We document every obligation and give you the tooling to meet it.
GDPR & UK GDPR
Full Data Processing Addendum available, incorporating EU Standard Contractual Clauses (SCCs) Module Two and the UK International Data Transfer Addendum.
View DPACCPA / CPRA
California Consumer Privacy Act and California Privacy Rights Act obligations documented in our DPA and Privacy Policy.
View Privacy PolicyTCPA compliance tooling
TrustedForm consent certificates, TCPA litigator scrubbing through The Blacklist Alliance, time-window routing rules, and a delivery trail for every lead routed through the platform.
Read the TCPA guideSub-processor transparency
Full list of sub-processors (Supabase, Vercel, Clerk, Stripe, Anthropic, and others) disclosed in our DPA with 30-day advance notice of any additions.
View sub-processorsInfrastructure & operations
We run on Vercel and Supabase, both SOC 2 Type II audited providers, configured for the lead distribution use case.
Enterprise cloud infrastructure
- Hosted on Vercel (iad1) and Supabase (us-east-1)
- Edge CDN with DDoS protection
- Managed Postgres database with Supabase-run backups
- Built on SOC 2 Type II audited providers (Vercel, Supabase, Clerk)
API-first architecture
- REST API for lead ingest and account management
- Incoming webhooks (Stripe, Clerk, Twilio) verified by signature before processing
- Per-key rate limiting on lead ingest
- Public API documentation, plus test leads that skip billing
Operational security
- Dependabot security alerts and update pull requests
- Environment-based secrets (no credentials in source control)
- Multi-factor sign-in available on every account
- Lead phone numbers and emails redacted in application logs
Frequently asked questions
The security questions we hear most from enterprise buyers.
Is Lead Distro AI SOC 2 compliant?
Not yet. The Lead Distro AI application does not have a SOC 2 report today. It runs on providers that do hold SOC 2 Type II reports (Vercel, Supabase, Clerk, Stripe). Enterprise customers can request our security questionnaire and those providers' attestations.
How is lead data encrypted?
All data in transit uses TLS 1.2 or higher. The database is encrypted at rest by Supabase. OAuth and API tokens for third-party integrations (Meta, Google, Microsoft, GoHighLevel) are also encrypted by our application with AES-256-GCM, using keys stored outside the database, so they cannot be read from a database backup alone.
Does Lead Distro AI support single sign-on (SSO)?
You can sign in with Google. SAML 2.0 single sign-on (Okta, Azure AD, OneLogin) is not available today. If your security policy requires SAML, contact sales so we can discuss your requirements.
What is your breach notification SLA?
72 hours. Our Data Processing Addendum commits us to notify affected customers without undue delay, and within 72 hours, after we become aware of a personal data breach.
Where is my data stored?
Data is stored in the United States (AWS us-east-1 via Supabase; Vercel iad1 for application hosting). We do not offer EU data residency today. International transfers are governed by the EU Standard Contractual Clauses (SCCs) Module Two.
How do you handle TCPA compliance for lead distribution?
Lead Distro AI includes TCPA compliance tooling: TrustedForm consent certificates captured with each lead, TCPA litigator scrubbing through The Blacklist Alliance, time-window routing rules, and a delivery trail that shows which buyer received which lead and when. TCPA obligations still rest with the customer as the data controller, but these tools help you enforce them before a lead reaches a buyer.
Can I request a security questionnaire or audit?
Yes. Enterprise customers can request our standard security questionnaire, sub-processor attestations, and reasonable audits of our controls. Contact support@leaddistro.ai with your request.
How do I report a security problem?
Email support@leaddistro.ai with the subject "Security report" and the steps to reproduce it. We reply within two business days. Only test against an account you own, and never access another customer's data. Scanning or probing the service without our written permission breaks our Acceptable Use Policy. We do not run a paid bug bounty.
Do you offer a Business Associate Agreement (BAA) for HIPAA?
Lead Distro AI is not currently a HIPAA-covered entity and does not sign BAAs by default. Customers processing protected health information (PHI) should contact sales before using the platform so we can assess whether a BAA and additional controls are appropriate.
Ready for enterprise lead distribution?
Start your 7-day free trial or request our security questionnaire and sub-processor list.
Questions? Email support@leaddistro.ai