LEADFAILSAFE · PRELAUNCH
Security policy
Last updated October 22, 2026
Terms · Privacy · Security · Acceptable use · Cookies
Report a concern
Email support@leadfailsafe.com with the affected URL, a brief description and safe reproduction steps. Do not include passwords, live tokens or unrelated personal information. This mailbox accepts vulnerability reports; no paid bounty, guaranteed response deadline or permission for intrusive testing is offered.
Account and workspace controls
The application uses expiring email login links, secure HTTP-only session cookies in production, request-forgery checks and workspace-scoped access. Owners control settings and membership. Read-only access does not grant configuration changes. API credentials are scoped, revocable and time limited. Platform staff access is restricted by operator configuration.
Monitoring safeguards
Public monitoring validates destinations and uses checked network egress to reduce access to internal/private addresses. Anonymous performance checks block form submissions and mutation requests. Form submissions require customer authorization, reviewed values and a successful baseline before scheduling. Capacity admission, maintenance windows and bounded retries reduce accidental or excessive activity.
Credentials and evidence
Operator renewal credentials are stored outside the source repository and supplied through hosting secrets. Customer-approved destination credentials are access restricted and must never be pasted into public profiles, chat or reports. Screenshots can contain website content; evidence requires authenticated workspace access. Retention cleanup limits stored evidence. Public status components require explicit owner publication.
Delivery and dependencies
Email delivery is tracked through provider feedback and a receipt test where configured; provider acceptance alone is not inbox receipt. Third-party delivery and network failures can still occur. We maintain a private repository and automated tests. These controls do not constitute an independent audit, penetration-test report or certification.
Current assurance limits
We do not claim SOC 2, ISO 27001, HIPAA certification, a guaranteed uptime SLA, a native secure mobile app or global infrastructure redundancy. A shared-responsibility review is required before monitoring regulated information or systems with special contractual security requirements.
Responsible testing
Limit any security investigation to your own account and non-destructive demonstrations. Do not scan third-party customers, exfiltrate data, brute-force authentication, generate alert floods or disrupt service. If you encounter another customer’s information, stop, retain only the minimum details needed to report it and contact us.
Cancel contract — submit a cancellation notice while signed out.
Withdraw from contract — submit a notice independently of the voluntary refund guarantee.
Google connections follow the Google API Services User Data Policy, including Limited Use.