Skip to content

Security

The practical measures we take to protect your workspace and your customers' data.

Last updated · ScaleDesk Technology Pvt Ltd

Your conversations and contacts are among your business's most sensitive data. This page describes the controls we operate today.

Data protection

  • Encryption in transit using TLS for the website, dashboard and API
  • Credentials encrypted at rest — WhatsApp access tokens, app secrets, AI keys, integration secrets and payment keys are encrypted before they are stored, and are never shown again in full
  • Passwords are hashed with a modern algorithm; we can't read them
  • Card and UPI details never touch our servers — payments are handled by Razorpay

Access control

  • Role-based access (owner, admin, agent, viewer) checked on every request, so removing someone takes effect immediately
  • Every workspace's data is isolated from every other's
  • Sessions use short-lived tokens with refresh and can be ended by changing your password
  • API keys are hashed, shown once and can be revoked at any time

Application security

  • Inbound WhatsApp and integration webhooks are accepted only if their signature verifies
  • Outbound webhooks are signed with HMAC-SHA256, and requests to private or internal network addresses are blocked
  • Rate limiting on sign-in, forms and APIs
  • Input validation and constrained file uploads
  • CSV exports neutralise spreadsheet formulas

Operations

  • Hosted on reputable cloud providers that maintain their own certifications
  • Managed database with backups
  • Health monitoring and a public status page

Independent audits

We have not yet completed an independent certification such as SOC 2 or ISO 27001 for LeadForGrow itself. If your organisation needs a security questionnaire or a data processing agreement, contact us.

Report a vulnerability

If you believe you've found a security issue, email support@leadforgrow.com with details. Please give us reasonable time to fix it before disclosing it publicly, and avoid accessing other people's data. We acknowledge reports promptly and appreciate responsible research.