Security and Vulnerability Disclosure

LeadGuard applies layered controls across transport, authentication, database access, storage, payments and abuse prevention. We do not claim independent certification against SOC 2, ISO 27001 or PCI DSS, and LeadGuard is not itself certified as a payment processor. Card payment handling is performed by Stripe.

Traffic to LeadGuard is served over HTTPS. The application runs on Cloudflare Workers edge infrastructure and connects to a managed Postgres database hosted in the Sydney (Oceania) region.

Authentication is provided by our managed authentication service, which supports email and Google OAuth sign-in. Administrative roles are restricted and separated from ordinary user access.

The Postgres database uses row-level security with distinct roles for anonymous, authenticated and service contexts. Application code uses the least-privileged role that satisfies each request.

Support attachments are stored in a private storage bucket and are accessible only via short-lived signed URLs generated by authorised server code.

Card payment fields are hosted directly by Stripe. LeadGuard does not receive or store payment-card numbers. Stripe webhooks are verified with a signing secret before any billing state is updated.

The public scan flow stores HMAC-SHA256 hashes of IP addresses, anonymous browser identifiers and user-agent strings for abuse-prevention and rate-limiting purposes. Plaintext IP addresses are not stored for public-scan abuse prevention.

Application and security logs are used to detect and investigate issues. Logs are retained for 90 days. Logs are designed not to capture unnecessary personal information.

UpWeb assesses incidents promptly and notifies affected customers, individuals and regulators where required by applicable law. Initial external communications about an incident are approved by David Adamson, Managing Director of UpWeb Pty Ltd.

To report a potential security issue in LeadGuard, email team@upweb.com with a clear description, reproduction steps and any relevant evidence. Where reasonably possible, we aim to acknowledge reports within three business days. LeadGuard does not currently run a paid bug-bounty programme and cannot guarantee acknowledgement times as a service-level commitment.