Security at BrokLeads

Where your data is hosted

The BrokLeads application and its PostgreSQL database run on Laravel Cloud in Singapore, behind its edge network with DDoS protection. The website and web app are served by Vercel from Mumbai, India. We do not currently host inside Pakistan, the UAE or Saudi Arabia. The outside companies that process data for us are listed in section 6 of our Privacy Policy.

Encryption

All traffic between your browser and BrokLeads is encrypted in transit using TLS (HTTPS). Data at rest, including database storage and backups, is encrypted by our infrastructure providers. Account passwords are stored using strong one-way hashing and are never kept in plain text.

Access controls & authentication

• Role-based access control: every user acts within a defined role (e.g. CEO, manager, agent) with only the permissions that role needs.
• API access uses bearer tokens; the web app keeps the session token in a secure, httpOnly cookie that scripts cannot read.
• Internal access to production is limited to authorised personnel on a least-privilege basis.

Per-branch data isolation

BrokLeads is multi-tenant by branch. Every branch-owned record is scoped to its branch at the data layer, and each request is verified against the user’s branch membership, so one business or branch cannot read another’s data. Attempts to access records outside your branch are rejected.

Application safeguards

• The access tokens businesses grant us for Facebook, WhatsApp and TikTok are encrypted in our database with an application key, on top of storage encryption, and are deleted when the business disconnects the integration.
• Sign-in attempts are rate-limited per IP address and per account, with a temporary lock after repeated failures.
• Password-reset, account-deletion and support-access links are single-use, stored only as a hash, and expire.
• In the mobile app, your sign-in token is kept in the device’s secure storage (iOS Keychain or Android Keystore), and you can require Face ID, Touch ID or fingerprint to open the app.

Activity logs

Changes to leads, clients and tasks, including assignments, are recorded with who made them and when, so business owners and managers can see what happened to a record. Support access by our staff is also logged.

Infrastructure & availability

The Service runs on reputable cloud infrastructure with managed networking and regular patching. Data is backed up on a routine schedule to support recovery, and the database has point-in-time recovery on Laravel Cloud. We monitor the platform for errors and abnormal activity.

Abuse & bot protection

Public endpoints are rate-limited, and public forms are protected against automated abuse (including honeypot fields and, where enabled, a Cloudflare Turnstile challenge). Provider webhooks are verified before their data is accepted.

Data handling

We process personal data in line with our Privacy Policy. Customers own their data and can ask us for an export of it; on account termination, data is returned on request and then deleted as described in our Terms of Service.

Security incidents

If we become aware of a security incident affecting your data, we will investigate promptly and tell affected businesses without undue delay, with what we know and what we are doing about it.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email support@brokleads.com with details and steps to reproduce. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and avoid accessing or modifying data that is not yours. We will acknowledge valid reports and keep you informed of our progress.

Contact

For any security question, reach us at support@brokleads.com.