Agents keep their clients' contact details, notes, and call recordings in LeadGPT, so this page describes how that data is protected today, in plain terms. It lists what is in place, not plans, and it is updated when something changes.

Hosting and encryption in transit

LeadGPT runs on Amazon Web Services in the US East region. Account and lead data is stored in an Amazon Aurora database, and files are stored in private Amazon S3 storage.
Every connection to LeadGPT uses HTTPS with TLS 1.2 or 1.3. Older TLS versions and plain HTTP are not accepted.
Files you attach to a lead are downloaded through links that expire after one hour.

Sign-in and sessions

Passwords are stored only as salted bcrypt hashes, never in readable form.
Password reset links are single-use, and a reset request gives the same response whether or not an account exists for that email.
Sessions use signed tokens that expire after 7 days. The iPhone and iPad app keeps its token in the iOS Keychain.
Sign-ins, sign-outs, and password resets are logged with the IP address and device.

Who can see your data

Each agent's leads and text conversations belong to their own account. Other agents can't see them, and neither can a team admin.
Team admins can review team members’ recorded calls, transcripts, and AI summaries in Team Hub, and see each member’s activity totals.
Calls made or answered in LeadGPT are always recorded, with no automatic announcement. If your state or your carriers require a recording disclosure, you give it.

API keys, webhooks, and payments

API keys are stored only as hashes, can be revoked at any time, and are limited to 60 requests a minute each.
Webhooks from Twilio and Stripe are verified by signature before LeadGPT acts on them.
Payments go through Stripe Checkout and the Stripe billing portal. Card numbers never reach LeadGPT’s servers.

Providers that process your data

LeadGPT uses these providers to run the features you use. Each receives only the data its part of the product needs.

Provider	What it does for LeadGPT
Amazon Web Services	Hosting, the database, and file storage
Twilio	Phone numbers, calls, texts, and call recordings
OpenAI	Call transcription, call and text analysis, Sofia, the AI Assistant, and AI profile estimates
Vapi	AI Receptionist and AI calling campaigns, including the speech providers Vapi uses (such as xAI and Deepgram)
Stripe	Subscriptions and payments
Mailgun	Email from LeadGPT, such as call summaries and alerts
Google	Calendar sync, when you connect Google Calendar

Lead data also goes wherever you send it: webhooks you set up, and integrations you connect, such as TMS Leads.

Health information

If you store health details about your leads, read HIPAA and health information in LeadGPT before you do. It explains what LeadGPT stores, which providers process it, and what to confirm with your compliance team.

Security questions and reports

For a security questionnaire, a question about how your data is handled, or to report a vulnerability, email support@leadgpt.com. Please include enough detail for us to reproduce any issue you report, and give us a chance to fix it before you share it publicly.