LeadsBox connects to your social channels through official APIs only. Your conversations, lead data, and business revenue are encrypted, isolated, and never shared.
All DM data, lead records, and settings are encrypted at rest using AES-256-GCM — the same standard used by banks. Unique keys per organisation.
Every request between your device and LeadsBox servers is encrypted with TLS 1.3. No data travels in plaintext — ever.
LeadsBox connects via official OAuth APIs. Your Instagram, WhatsApp, Facebook, and Telegram passwords are never sent to or stored by LeadsBox.
User passwords are hashed with bcrypt at cost factor 12. We never store plaintext passwords and cannot recover them — only reset them.
State parameters in all OAuth flows are cryptographically signed and verified server-side, preventing CSRF attacks during social account connection.
Every organisation gets a scoped data namespace. Multi-tenancy isolation means your data is structurally separated from all other LeadsBox accounts.
LeadsBox logs all team member actions — logins, lead updates, invoice sends, and setting changes — with timestamps. Pro plan feature.
API rate limits, failed login protection, and automated suspicious activity detection prevent brute-force attacks and credential stuffing.
LeadsBox connects to Instagram, WhatsApp, Facebook, and Telegram through their official developer APIs. We use OAuth 2.0 for authentication — your passwords are never sent to LeadsBox and we cannot access your account beyond what you explicitly grant.
Need a Data Processing Agreement? Download our DPA here · Questions? Contact us
Found a security vulnerability? We take all reports seriously and commit to responding within 48 hours. Please do not publish vulnerabilities before giving us time to fix them.
security@leadsboxapp.com7-day free trial. No credit card. Your data stays yours.