Legal
Security & Sub-processors
Last updated: 30 August 2026
We'd rather this page under-claim than over-claim: if you ask "is my data on its own server?", the answer below is the real one.
Security
- Multi-tenant, not dedicated. LeadView runs one shared PostgreSQL database (Supabase), with row-level security (RLS) enforcing isolation between tenants at the database layer - your data is not on a server of its own.
- Encryption in transit. All traffic to LeadView and the marketing site is over TLS/HTTPS.
- Encryption at rest for connected-account credentials. OAuth tokens and other tenant credentials are encrypted with AES-256-GCM before being stored, under a master encryption key held outside the database.
- Invite-only access. Tenants are created by AMT during onboarding; there's no public self-signup that could create an unvetted tenant.
We don't currently hold professional indemnity / cyber insurance, and we're not yet registered with the ICO for data protection - both are in progress.
Sub-processors
Providers who may process personal data on AMT's behalf in the course of running the marketing site, LeadView, or delivering the agency's own services. "Where used" tells you whether a provider touches LeadView client data (governed by our Data Processing Agreement) or only AMT's own business/marketing data (governed by our Privacy Policy).
| Provider | What for | Where used | Location / transfer basis |
|---|---|---|---|
| Vercel Inc. | Application hosting for LeadView | LeadView | US-headquartered, hosted in a US region - UK IDTA / EU SCCs + UK Addendum applies |
| Supabase Inc. | Database, authentication, file storage for LeadView | LeadView | US-headquartered (AWS-backed), hosted in a US region - UK IDTA / EU SCCs + UK Addendum applies |
| Google LLC | OAuth connections (Calendar, Drive, Sheets, Google Business Profile, GA4) and the Gemini API powering LeadView's AI features | LeadView | US-headquartered - UK IDTA / EU SCCs + UK Addendum applies |
| Meta Platforms, Inc. | Marketing API / Ad Library data for the Analytics and Ad Engine modules | LeadView | US-headquartered - UK IDTA / EU SCCs + UK Addendum applies |
| Cloudflare, Inc. | DNS and edge hosting for the marketing site | Marketing site (not LeadView client data) | US-headquartered - UK IDTA / EU SCCs + UK Addendum applies |
| Apify Technologies s.r.o. | Web-scraping actor used for competitor-ad discovery | LeadView (Ad Engine) | EU (Czech Republic) |
| Stripe | Payment processing for LeadView subscriptions | LeadView billing | UK/EU + US entities, PCI-DSS Level 1 certified; card data never touches AMT's own systems |
| GoCardless Ltd | Direct-debit collection (planned) | LeadView billing | UK-headquartered |
| Zoho Corporation | Business email | AMT internal (support correspondence) | EU data region |
| Twilio Inc. | SMS/voice communications for client service delivery | AMT service delivery (not core LeadView data) | US-headquartered - UK IDTA / EU SCCs + UK Addendum applies |
| Anthropic PBC | Claude API - used internally for AMT's own business operations, not inside the LeadView product | AMT internal only | US-headquartered - UK IDTA / EU SCCs + UK Addendum applies |
Changing sub-processors
Under our Data Processing Agreement, we'll give clients 30 days' notice before adding a new sub-processor that will process their personal data, via an update to this page plus a direct notification to active clients, so they can object if they have a genuine concern.
Reporting a security concern
info@ash-makes-things.com.