Security

Your company and contact details, the prospect shortlists and research briefs we compile for you, the emails we send and receive on your behalf in active client lanes, the facts you give us to keep messaging accurate, and durable records of completed jobs and costs.

We never hold payment card numbers, social security numbers, or sensitive personal data. Card details go directly to Stripe over encrypted connections and never touch our servers.

Autonomous systems must fail closed. Artificial intelligence models operate strictly as bounded, stateless workers inside clean, isolated execution sandboxes. They never hold direct write access to customer databases, transactional ledgers, or external communication networks.

All state transitions, queue leases, and delivery dispatches are governed by deterministic code with atomic checks and strict idempotency. Every input and output must conform to immutable, version-controlled JSON schemas. If a check cannot be proven, the system halts rather than guessing or failing open.

We verify digital deliverables and data files by their exact SHA-256 cryptographic byte hash, not by file path or self-reported status. Outbound adapters compute and match the exact byte checksum against an immutable ledger before releasing any deliverable or attachment. If a file is modified after review, the gate refuses to send.

Every database record carries an explicit client identifier. PostgreSQL row-level isolation enforces tenant boundaries: a database connection scoped to one client cannot read or write another client’s rows. Automated integrity tests run continuously against our live database to verify this separation.

For outbound communication, we maintain strict client seat walls: client mailboxes, sending identities, credentials, and burner domains are physically segregated. No client shares reputational pools, credentials, or thread memory with another.

Your data is stored in a Postgres database hosted by Supabase in the United States (AWS us-east-2), encrypted at rest (AES-256) by the cloud provider, with all connections over TLS 1.3. Daily backups are encrypted with AES-256 before leaving the database host, and the decryption key is stored independently. Internal workstations handling operational code enforce full-disk encryption.

All language model integrations use paid commercial enterprise APIs (Anthropic, Google AI Studio). Commercial agreements stipulate that customer inputs, research context, and outputs are never used to train base models. API data retention is limited to transient processing and standard 30-day security buffers before automated deletion.

Only the two founders of Lead Megaphone (both U.S. military veterans) and bounded, automated system service accounts. We employ no subcontractors and use no shared passwords. Credentials reside in an encrypted vault separate from version control, and multi-factor authentication (MFA) is enforced on every administrative account that supports it.

Data is exported and encrypted nightly and retained for 14 days. Every backup is verified upon creation: row counts and schema integrity are reconciled against the live database, alerting us immediately if a backup fails verification. Our target recovery time objective (RTO) is one business day.

We retain information for as long as we work together. When an engagement concludes, or upon your written request, we delete stored client memory, messaging history, and operational records within 30 days. Deleted records leave our encrypted backups within 14 days thereafter. Transaction invoices and required tax records are retained for seven years in compliance with legal standards. You may request a complete export of your data at any time before deletion.

These companies process client or operational data on our behalf under strict business agreements:

• Supabase— Database hosting (PostgreSQL, United States AWS us-east-2)
• Anthropic— Language model processing (commercial API, zero model training)
• Google AI / Gemini— Inbound triage sentry and automated schema validation (commercial API, zero model training)
• Google Workspace— Business email sending, receiving, and isolated client seats
• Smartlead— Outbound email delivery and dedicated sending domain isolation
• Stripe— Payment processing and billing (PCI-DSS Level 1 compliant)
• MillionVerifier— Email deliverability and technical mailbox verification
• Vercel— Website hosting and edge routing (TLS 1.3, strict HSTS, CSP)
• IONOS— Encrypted backup storage and server hosting

We inform clients in writing before adding any sub-processor that interacts with their data.

Our protocol is contain first, investigate second: any compromised credential is automatically revoked and affected pipelines paused. If client data is ever implicated, you will receive written notification from Omar within 72 hours of confirmation, detailing verified facts, pending inquiries, and immediate remediation steps.

To report a security issue, please use our contact form. We respond within one business day and will not pursue legal action against researchers who discover and report issues in good faith.

We do not claim SOC 2, ISO 27001, or HIPAA certification badges. We are a lean engineering firm, and we believe paper certification stamps often substitute checklist compliance for actual runtime defense.

Instead, we have engineered our systems directly around the core tenets of those frameworks: least privilege, strict tenant isolation, cryptographic integrity verification, encrypted credential vaulting, and fail-closed automated controls. Every control described on this page is backed by automated tests running continuously against our production codebase. What we will do is answer your vendor questionnaire honestly, sign a mutual data protection agreement, and stand behind our written commitments.