Security & data protection
Your pipeline is some of the most sensitive data your business has. Here's how we keep it safe — in plain English.
Your data is yours
You own everything you put into SmallBigLeads. We use it only to provide the service to you — never to sell, and never to train AI models. You can export your data at any time, and we'll delete it on request when you close your account.
Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest, and sensitive credentials — like the API keys you connect for integrations — are additionally encrypted at the application layer using AES-256-GCM before they ever touch the database.
Access control & audit
- Role-based access control so each teammate sees only what their role allows.
- A full audit log of sensitive actions — invites, role changes, and data changes.
- Passwords are hashed with bcrypt; we never store them in plain text.
Workspace isolation
Every workspace's CRM data lives in its own isolated database schema. One customer's data is never commingled with another's, which keeps a hard boundary between tenants at the data layer.
Payments
Billing is handled by Stripe. Card details go straight to Stripe over an encrypted connection — SmallBigLeads never sees or stores your full card number.
AI & your data
Our AI features process only the content needed to do the job — triaging a reply, drafting a follow-up, or briefing you before a call. Your data is not used to train foundation models. On higher plans you can bring your own AI key so requests run under your own provider account.
Subprocessors
We rely on a small set of trusted providers to run the service: Stripe (payments), our email delivery provider, Google (for the Gmail, Calendar and Meet integrations you choose to connect), our lead-data enrichment providers, our AI provider, and our cloud hosting and database infrastructure. We share only what each provider needs to perform its function.
Reporting a vulnerability
Found something? We'd genuinely like to hear from you. Email security@smallbigleads.com and we'll respond quickly. Please give us a reasonable chance to fix an issue before disclosing it publicly.
Questions about security or compliance?
Talk to us about your requirements — we're happy to walk through the details.