Security

1. Scope

This page applies to LeadX websites, applications, APIs, and data services. It does not apply to third-party sites we do not control.

This page complements the Privacy Policy; privacy practices stay on that page.

Our governance and control requirements are described in the Information Security Policy.

2. Report a Vulnerability

Email [email protected] with a description, the affected URL or API endpoint, and steps to reproduce. Do not access customer data, degrade service, or run destructive testing.

We will acknowledge reports sent to that address and work to remediate confirmed issues.

Incident-response continuity

Security reports are handled through a shared, role-based response channel rather than relying on one person's inbox. LeadX assigns both a primary incident commander and a deputy incident commander for active security incidents. The Head of Engineering serves as deputy incident commander. If the primary incident commander is unavailable or does not acknowledge an escalation within the internal response window, the deputy assumes command automatically. If neither assigned commander is available, the senior available incident responder becomes acting incident commander until a documented handoff occurs.

3. Authentication and Credentials

API access requires an API key in the X-API-KEY header. Unauthenticated calls to protected endpoints are rejected. Customers must protect their keys, rotate them if exposed, and not commit them to source control.

Account holders are responsible for activity under their credentials, as described in the Terms.

4. Transport Security

Public website and API traffic is served over HTTPS. The marketing site is fronted by Cloudflare. We aim to keep TLS current.

5. Access Control

Access to production systems and customer accounts is limited to personnel who need it to operate, support, or secure the services. We use unique credentials and revoke access when it is no longer required.

6. Application and API Safeguards

We monitor usage, debug issues, and protect against abuse. Rate limits, authentication requirements, and usage restrictions apply as described in the API docs and Terms. We may suspend access for misuse, unpaid accounts, or risk to the service or others.

7. Infrastructure and Availability

LeadX is operated as a cloud service. Production does not depend on our West Creek, NJ office being physically accessible. We maintain backups and recovery procedures for core data stores.

Current service availability is published at status.leadx.com. Security issues can be reported to [email protected] or (949) 541-4075.

8. Data Handling

Customer account, billing, and usage data are used to provide, secure, bill, and support the services, as described in the Privacy Policy. Exported data is the customer's responsibility to control.

LeadX data is not a consumer report and must not be used for FCRA-regulated decisions. See the Terms.

9. What This Page Is Not

This page is an overview for customers and researchers. It is not a certification, audit report, or penetration-test result. LeadX does not claim SOC 2 or ISO 22301 certification on this page.

10. Changes

We may update this page from time to time. The updated version will be posted on this page with a revised "Last updated" date.

11. Contact

LeadX Technologies, Inc.
West Creek, NJ
Irvine, CA
(949) 541-4075
[email protected]