Checkable claims, and the ones we refuse to make
You are being asked to hand over your customer list. Every claim on this page is a response header you can read yourself, a rule in the database, or a clause in the Terms with a number in it — because you cannot verify an adjective.
The second half of the page is the part that matters: everything Leadmend does not claim, and why. A security page with one false sentence on it is worse than no security page at all.
What is enforced, and what enforces it
Naming the mechanism is what lets you judge whether it would hold.
Every response carries security headers, and you can check them yourself
HSTS with a two-year max-age, X-Frame-Options DENY and frame-ancestors 'none' so the site cannot be framed for clickjacking, nosniff, strict-origin-when-cross-origin referrers, and a Permissions-Policy that switches off camera, microphone, geolocation and browsing-topics. Run curl -I against any page and read them.
A Content-Security-Policy restricts where content can come from and where forms can post
default-src 'self', object-src 'none', base-uri 'self' and form-action 'self' — so a stored-content injection cannot post your data to another origin, load a plugin, or rewrite relative links. Its limitation is stated below rather than buried: script-src still allows inline and eval.
A signed-in owner's queries can only reach their own rows
Row-level security is enabled on accounts, businesses, enquiries and builds. This is a real constraint on the dashboard read path — and it is not a blanket property of the database: the engine writes with a service credential that bypasses RLS, because an enquiry arrives when nobody is signed in. The precise version of this claim is the one worth having.
An opt-out cannot be forgotten by a new feature
The suppression check runs inside the send function, not at the call sites, so no outreach can reach the mail provider without passing it — campaigns, review requests, quote follow-ups and automated messages all go through that one function. One thing deliberately does not, and it is a reply rather than outreach: the answer to a message the customer has just sent. Opt-out records also survive deletion of the account that created them — the database detaches them instead of cascading, so one party's erasure cannot undo another party's withdrawal of consent.
Inbound webhooks are rejected unless they are cryptographically signed
Signatures are verified with a constant-time comparison, and an unset signing secret refuses the request rather than trusting it. A mismatch also raises an alert, because a rotated secret and a forged request look identical from inside the handler and the quiet failure is the expensive one.
You can delete everything yourself, immediately
Account deletion runs from Settings and takes effect at once — not a support ticket and a thirty-day window. One exception, and it protects you: if you are on a paid plan we cancel the subscription first, and if that cancellation fails we stop rather than delete an account that is still being billed. What is retained afterwards, and why, is listed in the privacy policy. Opt-out records are the deliberate exception.
The public AI endpoints cannot be run up as a bill
A durable cap counts real rows in the database rather than trusting an in-memory counter, so it holds across serverless instances instead of resetting whenever a new one warms up.
If we are breached, you hear within 72 hours
Section 7 of the Terms commits to telling you within 72 hours of becoming aware, in plain language: what happened, what data was involved, what has been done, and what you need to do — whether or not the law requires it in your jurisdiction.
What we will not claim
Each of these would be easy to imply and impossible to defend. They are listed so you do not have to work out which ones are missing.
No SOC 2, ISO 27001 or any other certification
None has been carried out. There is no report to share and no badge to display, so none appears anywhere on this site.
No third-party penetration test
None has been commissioned yet. The test suite is not a substitute for one and is not presented as such.
The Content-Security-Policy is not strict
script-src allows 'unsafe-inline' and 'unsafe-eval'. Tightening it is real work, not a config flag, and until it is done the honest description is a useful policy with a known gap.
Data does not stay in Canada
Several processors hold data outside Canada, principally in the United States. PIPEDA permits this and requires it to be disclosed; the privacy policy names every processor and what each one handles.
No uptime guarantee
Nothing here measures uptime yet, and a number nobody measures is decoration. Section 3 of the Terms says so directly.
No GDPR or CCPA compliance claim
Neither has been assessed. What is true — named sub-processors, cross-border processing disclosed, no sale of data, no model training, deletion on request — is in the privacy policy instead of a badge.
The detail behind all of this is in the privacy policy and the Terms. If you are weighing up the Canadian rules specifically, the CASL and PIPEDA page goes clause by clause. Found something here that is wrong, or want a question answered before you sign up? Email hello@leadmend.com.
Put your AI to work today.
Create your account and describe your business in a chat — your AI starts answering enquiries in minutes, in your words. Your own website and a custom agent come with Growth, when you want them.