Security

How we protect your conversations

LeadInbox holds the messages your business runs on. This page describes the controls that are actually in place today — and, just as plainly, the ones that are not.

Infrastructure

  • All traffic to and from LeadInbox is served over HTTPS/TLS. There is no unencrypted route into the application or its API.
  • The application is hosted on Vercel and the database, authentication and file storage are provided by Supabase. Both are managed platforms with their own operational security programmes.
  • Anonymous database access has been revoked at the Postgres role level, so no table is reachable without an authenticated session — not even in the event of a misconfigured policy.

Data isolation

LeadInbox is multi-tenant, and separation between workspaces is enforced by the database rather than by application code alone.

  • Every table carries a tenant identifier. There is no shared, un-scoped table holding customer conversations, contacts or leads.
  • Postgres row-level security policies scope every read and write to the tenant of the signed-in session, so a query that forgets its filter returns nothing rather than someone else's data.
  • Elevated service-role access is used only for server-side work that cannot run in a user session — inbound webhooks, billing events and administrative tooling — and never from the browser.

Authentication

  • Sign-in is handled by Supabase Auth, with a choice of a password or a one-time code sent to your email address.
  • Passwords are hashed and held by Supabase. We never store or see a plaintext password, and there is no place in our own database where one is written.
  • API access is authenticated on every request, using a session cookie, a signed token for embedded use, or a workspace API key. Each API route authenticates independently — there is no endpoint that assumes an earlier check happened somewhere else.

Credentials and secrets

  • Credentials for your connected channels — WhatsApp, LinkedIn, Instagram, Messenger, Telegram, X and your email accounts — are held by Unipile, our channel connectivity provider. They are not stored in our database. Accounts are connected through a hosted flow, so the credentials are never typed into a LeadInbox screen.
  • Message attachments live in a private storage bucket that is not publicly readable. When you open an attachment it is served through a short-lived signed URL that expires shortly after it is issued.

Payments

Subscription billing runs entirely through Stripe. Card details are collected by Stripe's own checkout and customer portal — card numbers never reach our servers and are never stored by us. What we hold against your workspace is the billing contact details, the plan you are on, and the invoice records Stripe reports back.

Your AI keys

LeadInbox's AI features run on an API key you supply for the provider you choose. That key is treated as a secret:

  • It is stored server-side and is write-only through the interface. Once saved, the key is never returned to the browser — the settings screen shows that a key is configured, not the key itself.
  • It is used solely to call the provider you selected, for the features you enabled, in your own workspace. It is never used for another tenant and never sent anywhere else.
  • If no key is configured, no AI calls are made at all. The inbox, pipeline, contacts and templates work without one.

What is not in place yet

Stating this plainly is more useful to you than implying otherwise. LeadInbox has not undertaken a formal third-party security certification or audit: we do not hold SOC 2 or ISO 27001, we have not commissioned an external penetration test, and we do not run a paid bug bounty programme. Nothing on this page should be read as a certification claim.

What is described above is what the product does today. If your procurement process requires evidence we do not yet have, tell us what you need at contact@desklink.ai and we will give you a straight answer about whether and when we can meet it.

Reporting a vulnerability

If you believe you have found a security issue in LeadInbox, please email contact@desklink.ai with “Security” in the subject line. Include enough detail to reproduce the issue — the affected URL or endpoint, the steps you took, and what you observed.

Our commitments to you:

  • We will acknowledge your report and keep you informed of what we find and what we do about it.
  • We will not pursue or support legal action against researchers who report in good faith, act in accordance with this page, and give us a reasonable opportunity to fix the issue before disclosing it.

In return, please avoid accessing, modifying or deleting data belonging to anyone else, avoid degrading the service for other customers, and use a test workspace of your own where possible. We do not currently offer monetary rewards for reports.

Privacy and subprocessors

This page covers security controls. What data we collect, why we hold it, how long we keep it and the rights you have over it are set out in our privacy policy, which also carries the full list of subprocessors — every third party that processes customer data on our behalf, what each one is used for, and what it receives.

LeadInbox is operated by DeskLink Ltd, trading as DeskLink AI. Security questions that are not vulnerability reports are welcome at the same address, or through our contact page.