Trust and security
How we handle your data
leadmaps is privacy-first analytics. That is only credible if the infrastructure behind it earns the claim. This page is the shorter-than-the-DPA, longer-than-marketing version of what we actually do.
For the practical walkthrough of running analytics under GDPR, read GDPR-compliant analytics, enforced at the server.
Last reviewed 2026-05-17.
Security highlights
EU residency by default
Events ingested through collect.leadmaps.nl land in Fly Postgres in Amsterdam, and authentication state in Supabase Paris (eu-west-3). EU residency is the default on every plan.
Encryption everywhere
TLS 1.3 on every public endpoint with HSTS enforced. OIDC client secrets, per-site proxy secrets, and warehouse-destination credentials are AES-256-GCM encrypted at rest under a Key Encryption Key (KEK) held only in-process. Workspace API keys are stored as SHA-256 hashes, and license keys are Ed25519-signed with no secret stored, so a database dump alone reveals nothing usable.
No passwords, no shared accounts
Magic-link auth by default, with optional TOTP per workspace. SAML 2.0, OIDC, and SCIM are available on Business plans. One operator is one identity, with MFA enforced for every staff account.
RLS-forced by default
Every customer-data table in Supabase has Row-Level Security forced with zero policies, meaning service-role access only. Per-workspace authorisation happens at the application layer, and no path bypasses the gate.
Every operator action audited
Every leadmaps staff action against your workspace is logged with actor, target, and before-and-after diff. The customer-side audit log surfaces config changes, IP allowlist updates, retention-policy changes, and operator impersonation.
72-hour breach notification
Following GDPR Art. 33, we file with the Dutch DPA within 72 hours of detecting a personal-data breach. Workspace admins are emailed directly within 4 hours for S0 and S1 incidents.
Sub-processors
Vendors we use to deliver the service. Sub-processors maintain independent security programs, including SOC 2 Type II or equivalent where applicable. The live sub-processor list is available in the dashboard DPA at app.leadmaps.nl/settings/legal (sign-in required).
| Vendor | Purpose | Region |
|---|---|---|
| Vercel | Dashboard hosting and edge functions | Global |
| Fly.io | Collector and Postgres (event storage) | EU (ams, fra) |
| Supabase | Dashboard auth and control-plane database | EU (Paris) |
| Paddle | Subscription billing | Global |
| Resend | Transactional email | US |
| Sentry | Error reporting (PII-scrubbed) | EU (Frankfurt) |
| Backblaze B2 | Encrypted off-site database backups | EU (eu-central-003) |
| Hostinger | Login email delivery (magic links) | EU |
| AWS S3 | Conditional: only when you configure an S3 export destination, so data flows to the bucket and region you choose | Customer-chosen |
Certifications
- SOC 2 Type IIPreparation underway. Not yet audited or certified.
- ISO 27001Planned after SOC 2
- GDPRArt. 28 DPA available via /settings/legal in the dashboard
- CCPASelf-attested
- HIPAAOn the roadmap. No BAA offered today.
SOC 2 Type II report
SOC 2 Type II readiness is underway internally. There is no completed report yet, and we make no claim of certification. The download link appears here once a report is delivered. In the meantime, enterprise customers under NDA can request our current security evidence pack via security@leadmaps.nl.
Reporting a vulnerability
Email security@leadmaps.nl. Include reproduction steps, the affected surface (dashboard, collector, SDK, or API), an impact estimate, and your preferred disclosure timeline. We respond within 48 hours.
Our default disclosure window is 90 days for non-critical findings. Active-exploit reports are treated as S0 incidents with immediate mitigation.
Need more detail?
Enterprise customers can request our full security policy, incident-response playbook, and SOC 2 evidence pack under NDA. Reach security@leadmaps.nl.