Security policy

This Security Policy describes how Lulo Solutions LLC (the “Company”) protects the data held in Leepr (the “Service”). It forms part of the Terms of Service and of the Data Processing Addendum. In this Policy, “Agency Data” means the information an Agency and its Authorized Users keep in the Service.

1. Data Protection Standards

Company uses commercially reasonable organizational and technical measures to protect Agency Data, including: limitation of access on a need-to-know basis; multi-factor authentication for administrative access; individually assigned SSH keys for external engineers; and prohibition on storage of Agency Data on unauthorized portable devices.

2. Separation Between Agencies

Every record in the Service belongs to one Agency, and the Service refuses to read or write records without knowing which Agency a request acts for. Each Agency works on its own address on leepr.app. Within an Agency, roles decide what each Authorized User can see and do, and the Agency’s audit log records who changed what. A branch or sub-agent never sees the records of its parent or of any other organisation.

3. Accounts and Sign-in

Passwords are stored only as one-way hashes. Every Authorized User can turn on two-factor authentication, and can sign in with Google or Microsoft instead of a password. Sign-up and sign-in are protected against automated abuse with Cloudflare Turnstile and rate limits. Internal administration of the Service uses a separate address and separate accounts, which require two-factor authentication.

4. Data Encryption

Data is encrypted in transport using TLS (HTTPS) between browsers and the Service and between the Service and the providers it uses. Data at rest is stored on encrypted storage. Government-issued identification numbers that an Agency stores, the access tokens for connected calendars, and the keys for Sponsor connections are additionally encrypted by the Service itself. Backups are encrypted.

5. Files and Documents

Documents uploaded to the Service, such as passports and transcripts, are stored privately and are never served directly: the Service delivers them only through short-lived, signed links to Authorized Users who are allowed to see them. Deleting a lead or contact deletes its files at the same time.

6. Sponsor Connections

An Agency connects a Sponsor by signing in at the Sponsor’s own system and approving the Service; the Service never receives the Agency’s password at the Sponsor. Each connection holds a key that the Sponsor issues for the Agency’s own account there and can revoke at any time, and it can only see and do what the Sponsor allows that account.

7. Network, Physical, and Environmental Controls

The Service’s servers, database, stored files and email are hosted in the European Union, behind Cloudflare, which provides network protection. Company maintains network, physical, and environmental controls that include security patch assessment and testing, privileged access monitoring, VPN and encrypted connection requirements for remote access, and adherence to industry best practices for information security.

8. Security Limitations

No method of data transmission over the Internet and no electronic storage mechanism is completely secure. While Company employs commercially reasonable measures, Company cannot guarantee absolute security of Agency Data.

9. User Account Security

Agencies and their Authorized Users are responsible for maintaining the confidentiality of their account credentials and must notify Company immediately at the designated security contact of any suspected unauthorized access to their account.

10. Security Assessments

Company conducts regular penetration testing performed by independent third-party security experts, including both black-box automated and manual testing methodologies. High-level summaries of assessment results are available to Agencies upon request.

11. Incident Response

Upon discovery of any unauthorized access to Agency Data, Company shall take reasonable measures immediately to investigate and contain the incident. Company shall notify the Agency’s designated security contact within twenty-four (24) hours of confirming such unauthorized access. Such notice shall include: the extent of exposure, a description of the incident, the timeline of events, the scope of affected data, and the response measures taken or planned.

12. Business Continuity

Company maintains a business continuity and disaster recovery plan and maintains reasonable processes to ensure failover redundancy with respect to systems, networks, and data storage. The database is backed up daily with point-in-time recovery, stored files daily, and backups are kept for thirty (30) days.

13. Personnel Management

Company conducts employment verification for all new hires who will have access to Agency Data. All such personnel receive training on their confidentiality obligations. Company continuously monitors employee activity within the production environment and immediately disables access upon termination of employment.

14. Secure Software Development

Company implements software development practices that are designed to reasonably protect Leepr software from tampering and unauthorized access, minimize security vulnerabilities in each release, and provide timely responses to address identified vulnerabilities. Errors are reported to the Company’s monitoring without personal data.

15. Reporting a Vulnerability

If you believe you have found a security vulnerability in Leepr or on leepr.app, write to security@exlink.org with enough detail for us to reproduce it. Please do not access or change data that is not yours, and give us reasonable time to fix the issue before disclosing it. The same contact is published at leepr.app/.well-known/security.txt.

All questions regarding security practices should be directed to security@exlink.org.