Security

LeadTrack uses Supabase Row Level Security (RLS) to enforce tenant isolation. Every query that reads or writes lead, pipeline, activity, task, or audit data checks that the requesting user belongs to the same organization_id as the record. Users cannot access data from other organizations.

Each organization has four roles — Owner, Admin, Member, and Viewer — with progressively narrower permissions. For example, lead creation and updates are limited to appropriate roles, and deletion is restricted to Owners and Admins. The last Owner cannot be removed, preventing accidental lockout.

User authentication is handled by Supabase Auth. Passwords are never stored or transmitted in plaintext. LeadTrack supports secure password reset via time-limited, single-use email links.

All traffic between your browser and LeadTrack servers is encrypted with TLS/HTTPS. Webhook ingestion endpoints and API calls use the same encrypted transport.

The public Supabase key is exposed to the browser for authenticated queries under Row Level Security. The service role key is kept server-side and is never shipped to the client or included in frontend code.

The production database is protected by Supabase-managed daily automated backups, allowing recovery from accidental deletion or infrastructure failure.

Changes to lead fields (stage, assignee, name, email, phone, tags, source, and note) are recorded in an audit log that stores the old value, new value, actor, and timestamp. This supports accountability, history review, and undo operations.

We rely on the Supabase security linter and regular dependency reviews to surface misconfigurations such as overly permissive database functions or missing Row Level Security policies. Findings are remediated before they reach production.

If you discover a security issue, please email us at security@leadtrack.vector8labs.com. Please do not publicly disclose vulnerabilities before we have had a chance to address them.