Security you can check.

• Stored and processed in Frankfurt

  The application servers (Vercel Functions), the database (Neon Postgres) and the private Vercel Blob store for uploaded files and daily backups are all in Frankfurt, Germany (AWS eu-central-1, Vercel region fra1). Customer and lead data is stored and processed in the EU. Vercel's global edge network terminates connections and caches public pages close to each visitor, so a request can pass through an edge location outside the EU on its way to Frankfurt. Services a customer connects, such as HubSpot, Slack and Telegram, and our e-mail and payment providers process data where they operate.

• One organisation, one set of data

  Every record belongs to an organisation and the application scopes every query to it. An automated check in CI flags any query without an organisation filter. This is enforced in the application, not by row-level security in the database.

• No cookies on cards

  Cards set no cookies for visitors and there is no third-party analytics on a card. Card views and short-link clicks store no IP address. Unique visitors are counted from a salted hash of IP address and browser that changes every day.

• Consent and evidence on every lead

  Each lead keeps the exact consent wording it was given. A lead form submission or a meeting booking also stores the sender's IP address and browser user agent. The organisation's admins can see them on the lead, and they are included in backups.

• Erasure, and what it cannot reach

  Delete all data for this email removes that person's leads, meetings and notes from the live database. If a CRM is connected, it also asks the CRM to delete the contact, once: if the CRM is disconnected or its access has expired, that does not happen. It does not change daily backups taken before the deletion, and it cannot recall data already sent to Slack, Telegram, e-mail or webhook receivers.

• Roles and sessions

  Owners, admins, members and viewers. Members see only the leads of their own cards. Viewers can see all leads. A password change or a deactivation ends that person's browser sessions.

• Single sign-on

  People can sign in with Google or Microsoft Entra ID (OpenID Connect) on every plan. On Business, an owner can require single sign-on for everyone in the organisation, and owners keep their password as a way back in. There is no SAML and no SCIM.

• API and MCP tokens

  A token acts for the whole organisation with a read or write scope. It is shown once and can be revoked at any time. Tokens do not expire on their own and are not revoked when the person who made them leaves, so admins should revoke the ones nobody needs.

• Signed webhooks, encrypted credentials

  Webhooks are signed with HMAC-SHA256 and a timestamp, with one signing secret per organisation. CRM credentials, such as the HubSpot token, are stored encrypted with AES-256-GCM.

• Form limits

  Public forms are rate limited per source and pass an invisible bot check (Vercel BotID) when they are sent. A repeat lead from the same e-mail address within 24 hours is skipped, and a visitor gets the follow-up e-mail only after confirming their address.

• Backups

  Each organisation's data is backed up daily to a private Vercel Blob store in Frankfurt. Backups include the IP addresses and user agents stored with leads and meetings. An erasure does not change backups taken before it.

The data processing addendum is part of the terms for every plan and lists our sub-processors. Need a security questionnaire answered? Talk to us