Security
Last updated: November 8, 2026
Report a security problem: write to operator@zoom-gtm.com with "Security" in the subject. Our security.txt has the same contact.
Infrastructure
- FreshLeads runs on Amazon Web Services in the United States (us-east-1), on managed services: CloudFront, Lambda, DynamoDB and S3.
- All traffic uses HTTPS (TLS 1.2 or later). Storage buckets block public access and accept only TLS requests.
- Data at rest is encrypted. Secrets that members connect, such as AI provider keys, email provider keys and mailbox credentials, are encrypted with AWS KMS.
- Card data never reaches our servers. Stripe handles payments.
Access
- Each account sees only its own filters, contacts, chats and settings. The API checks the account on every request.
- API keys belong to one account. A member can rotate a key at any time in Settings.
- Only a small operator team can reach production systems. We keep production credentials in environment files and parameter stores, not in source code.
AI connector
- The connector is a remote MCP server on HTTPS. Members sign in with OAuth 2.1 and approve the access an assistant asks for.
- Each tool says if it only reads data or if it changes data, so the assistant can ask the member before a write.
- Tokens are stored encrypted, are limited to one account, and can be revoked at any time.
- Content from websites and from email can contain instructions that try to steer an AI (prompt injection). Tool results mark such content as untrusted data, and no tool sends email without a member action.
Email safety
- Members send from their own verified domains or Gmail accounts, with daily send limits for each sender.
- First emails get an automatic review for high-risk content. Replies of "no" or "stop" go to a suppression list, and complaints can never be overridden.
Certifications
We do not hold a SOC 2 or ISO 27001 certification at this time. Our hosting provider, AWS, holds these certifications for its infrastructure.
Responsible disclosure
Please give us reasonable time to fix a problem before you make it public. Do not access other members' data, do not degrade the service, and do not use social engineering. We will reply to your report, keep you informed, and credit you if you want.