Information Security Policy

1. Purpose

This policy establishes LeadX's approach to managing information-security risk and protecting the confidentiality, integrity, and availability of information and systems. It provides a public summary of our security requirements; supporting internal standards, procedures, configurations, and response materials are not published.

2. Scope

This policy applies to LeadX personnel and contractors, information handled on behalf of LeadX or our customers, and systems used to develop, operate, support, or secure LeadX websites, applications, APIs, data products, and business operations.

Service providers are addressed through risk-appropriate contractual, technical, and operational safeguards.

3. Governance and Accountability

LeadX leadership is accountable for information-security risk. Security responsibilities are assigned by role, and system or data owners are responsible for applying this policy within their areas.

• Security risks are considered alongside business, legal, privacy, and operational requirements.
• Material risks and incidents are escalated to the appropriate decision makers.
• Security requirements are reviewed when services, threats, dependencies, or legal obligations materially change.

4. Risk Management

LeadX identifies important systems, information, business processes, and service dependencies and evaluates threats and vulnerabilities in proportion to their potential impact. Risk responses may include mitigation, transfer, avoidance, or documented acceptance by an authorized owner.

Security priorities are risk-based. Systems that process sensitive information or support critical services receive greater protection and remediation priority.

5. Identity and Access Management

Access to LeadX systems and information is limited according to business need and least-privilege principles.

• Users receive unique accounts where supported and must protect their authentication credentials.
• Elevated access is restricted, approved, and separated from ordinary use where practicable.
• Multi-factor authentication is required for supported systems when appropriate to the access risk.
• Access is reviewed and removed or adjusted when responsibilities or relationships change.
• Secrets and API keys must not be embedded in public source code or shared through unauthorized channels.

6. Data Protection

Information is handled according to its sensitivity, contractual requirements, and business impact. LeadX applies administrative, technical, and organizational safeguards designed to protect information throughout its lifecycle.

• Public website and API traffic is served over HTTPS.
• Sensitive information is limited to authorized uses and recipients.
• Retention and disposal are based on operational, contractual, and legal needs.
• Backups and recovery measures are used for core data and services based on business requirements.

Privacy practices are described separately in the Privacy Policy.

7. Secure Development and Change Management

Security is considered when LeadX designs, develops, tests, deploys, and changes software and infrastructure. Changes are reviewed and validated in proportion to risk before production use. Access to source code, deployment systems, and production configuration is restricted to authorized personnel.

Credentials must be separated from source code. Dependencies and externally sourced components are evaluated and updated based on risk, compatibility, and available remediation.

8. Infrastructure and Service Protection

LeadX uses layered safeguards appropriate to the service, including secure configuration, access restrictions, transport protection, defensive network or edge services, backups, and operational monitoring. Systems are maintained and patched according to risk and operational constraints.

Detailed network diagrams, security configurations, credentials, detection logic, and internal response procedures are confidential.

9. Vulnerability Management

LeadX evaluates identified vulnerabilities, prioritizes them based on risk and exposure, and tracks remediation or authorized risk treatment. Testing and remediation must avoid unnecessary risk to production services and customer information.

Researchers can report potential vulnerabilities under our Security and Vulnerability Reporting guidance.

10. Logging and Monitoring

LeadX records and reviews security-relevant events where appropriate to support operations, abuse prevention, investigation, and incident response. Access to logs is restricted, and retention is based on security, operational, contractual, and legal requirements.

Monitoring practices are adjusted as systems and risks change. The absence of a public alert does not mean that an event was not detected or investigated.

11. Incident Response

Potential incidents are evaluated, contained, investigated, remediated, and recovered according to severity and available evidence. LeadX preserves relevant information and coordinates legal, privacy, customer, and service communications when appropriate.

Active security incidents have a primary incident commander and a deputy incident commander. The Head of Engineering serves as deputy incident commander. If the primary incident commander is unavailable or does not acknowledge an escalation within the internal response window, the deputy assumes command automatically. If both are unavailable, the senior available incident responder becomes acting incident commander until a documented handoff occurs.

12. Availability and Recovery

LeadX maintains recovery measures for critical services and data based on business impact. Recovery procedures may include backups, service restoration, infrastructure replacement, dependency coordination, and validation before normal operations resume.

Current public service information is available at status.leadx.com.

13. Third-Party Risk

LeadX relies on service providers for portions of our technology and business operations. Providers are evaluated in proportion to the service, data, access, and operational risk they introduce. Security and confidentiality requirements may be addressed through provider capabilities, configuration, contracts, monitoring, or replacement when appropriate.

14. Personnel and Endpoint Security

Personnel and contractors are responsible for following security requirements applicable to their roles, protecting company information and devices, and reporting suspected incidents promptly. Access is adjusted or revoked when a role or relationship ends.

Devices used for LeadX work must use reasonable safeguards appropriate to the information and access involved, including supported software, access controls, and timely security updates.

15. Customer Responsibilities

Customers must protect their accounts, API keys, exports, integrations, and authorized users. Customers should use appropriate access controls, rotate exposed credentials promptly, and notify LeadX of suspected unauthorized use.

Additional customer obligations are described in the Terms and applicable agreements.

16. Exceptions, Compliance, and Review

Exceptions to this policy require authorization by an appropriate risk owner and must be limited in scope and duration when practicable. LeadX considers applicable legal, contractual, privacy, and regulatory obligations when implementing security requirements.

This policy is reviewed at least annually and after material changes or incidents when appropriate. It may be updated as our services, risks, and obligations evolve.

17. Assurance and Contact

This public policy is not a certification, audit report, penetration-test result, warranty, or guarantee that incidents will never occur. LeadX does not claim SOC 2 or ISO certification through this policy.

Questions about this policy or potential security issues can be sent to [email protected]. Please include the affected service and enough information for us to route the request appropriately.

LeadX Technologies, Inc.
West Creek, NJ · Irvine, CA
(949) 541-4075