Security

Your pipeline is your business. We protect it like ours.

Security is built into every layer of Freeleads — from how we store passwords to how we handle the professional data of the people you contact.

Encryption everywhere

All traffic uses HTTPS with HSTS. Two-factor secrets are encrypted at rest with AES-256-GCM. API keys, session identifiers and one-time links are stored only as SHA-256 hashes.

Modern password storage

Passwords are hashed with argon2id following OWASP recommendations, checked against common-password lists, and never logged or emailed.

Two-factor authentication

Protect your account with any TOTP authenticator app, with single-use recovery codes. Administrators are required to use 2FA.

Session security

Server-side sessions in HttpOnly, Secure, SameSite cookies, rotated on every sign-in, with idle and absolute timeouts. See and revoke your active sessions anytime.

Abuse protection

Rate limiting, progressive account lockout, CSRF protection on every form, and email alerts for important account changes.

Hardened web app

A strict Content Security Policy with no inline scripts, anti-framing headers, output escaping by default and parameterised database queries.

Privacy & GDPR

  • Data minimisation. We only process the professional data needed to deliver Freeleads: names, job titles and business contact details of decision-makers.
  • Right to object, honoured instantly. Anyone listed as a decision-maker can request removal. Their data is erased and their email is added to a permanent suppression list.
  • Your data is yours. Export everything as JSON or permanently delete your account from your settings, at any time.
  • No tracking. No advertising cookies, no third-party analytics, no fonts loaded from third parties.
  • Payments. Card payments are handled by Stripe (PCI-DSS Level 1). Card numbers never touch our servers.

Responsible disclosure

If you believe you have found a security vulnerability, please email security@freeleads.fr with steps to reproduce. We acknowledge reports within two business days and will not take legal action against good-faith research that respects user privacy and avoids service disruption. Our security.txt is published per RFC 9116.