Trust & Security

1. 1

   A customer calls your LeadLock number. Twilio carries the call. Ava tells the caller it's an AI assistant and that the call may be recorded and transcribed.

2. 2

   Ava listens and replies. Speech is turned into text. That text, with your services and open times, goes to an AI model that writes Ava's next line. Providers can't train on it.

3. 3

   The details land in your CRM. Name, number, address, the job, a transcript and a summary are saved to your workspace only.

4. 4

   The job is booked and dispatched. Your dispatcher assigns a technician. The technician's phone shares location only while the job is active.

5. 5

   The customer is kept up to date and pays. Texts go out only with consent. Payment happens on a Stripe page.

Every lead, call, message, job and invoice is tied to a single workspace, and every request is checked against the signed-in user's workspace before any data is returned. Data is encrypted in transit with HTTPS and stored with managed providers that encrypt it at rest. We don't sell your data or your customers' data, and you can export or delete your workspace from Settings.

• Owners control billing, settings, team members and deleting the workspace.
• Admins and managers run day-to-day operations. Changes to invoice fees and payment settings are limited to owners and admins.
• Dispatchers schedule and assign work.
• Technicians see only the jobs assigned to them in the Technician App.

Every user has their own login, and two-factor authentication is available for all of them.

• Ava identifies itself as an AI assistant on every call and answers truthfully if asked.
• Ava only quotes the services and prices you entered, reads back addresses, and tells callers in danger to call 911.
• Nexus works within the signed-in user's permissions, and asks a person to approve anything that contacts a customer, changes money or deletes data. Every action is logged.
• AI providers process your data only to answer the request and may not train their models on it.
• You can turn AI answering off, or limit it to after hours, at any time in Settings.

Read the AI & voice disclaimer for what AI can and can't do.

• Before any automated text, LeadLock checks for recorded consent. Texts without it are blocked and the attempt is logged.
• Each consent record keeps the exact wording shown, its version, the source and the time, so you can prove it later.
• STOP and the other standard opt-out words are honored immediately, and texts to opted-out numbers are blocked.
• Promotional texts stay off until marketing consent and a registered marketing campaign are in place.
• Incoming Twilio and Stripe requests are verified with their signatures, so fake webhooks are rejected.

Subscriptions, invoices and payment links all use Stripe-hosted pages, and payouts use Stripe Connect. Card numbers go straight to Stripe, which is certified to the highest level of the Payment Card Industry security standard (PCI DSS Level 1). LeadLock stores only the amount, status and last four digits.

A small number of LeadLock staff can use an internal admin tool to help with support requests, billing, abuse and keeping the service healthy. Access requires separate sign-in with two-factor authentication, is limited by role, and sensitive actions are logged. We don't browse your CRM for any other reason.

• If the AI can't answer a call, the caller hears a short message and can leave a voicemail, which is transcribed into your CRM, so the lead isn't lost.
• If a text can't be delivered, the failure is recorded on the conversation so your team can follow up.
• We can switch AI features off across the platform in an emergency without taking down the rest of LeadLock.
• If an incident affects your data, we will notify you as the law requires.

These companies process data for LeadLock. Each has its own security program, and we send each only what its job requires.

• Vercel

  Always

  Application hosting and edge network

  Receives: All request data passing through the app

• Neon

  Always

  Managed PostgreSQL database

  Receives: Account, CRM, message, call and billing records

• Twilio

  Always

  Phone numbers, calls, SMS, speech recognition and standard text-to-speech (including Amazon Polly voices)

  Receives: Phone numbers, call audio, speech transcripts, message content and delivery status

• Anthropic

  If turned on

  AI model for the Ava phone receptionist, Nexus and the AI agent

  Receives: Conversation text and the business context needed to answer

• OpenAI

  If turned on

  AI model for the website chat assistant, SMS replies, summaries, and backup when another model is unavailable

  Receives: Conversation text and the business context needed to answer

• ElevenLabs

  If turned on

  Natural-sounding text-to-speech for voice features

  Receives: Text of replies to be spoken

• Stripe

  Always

  Subscription billing, hosted checkout, invoices and payouts (Stripe Connect)

  Receives: Billing contact, payment and payout details

• Resend

  Always

  Transactional email

  Receives: Email address and message content

• Cloudflare R2

  If turned on

  Storage for uploaded photos, files and media

  Receives: Files you or your customers upload

• Google Maps Platform

  If turned on

  Driving directions and travel times for dispatch

  Receives: Job and technician addresses or coordinates

• OpenStreetMap Nominatim

  If turned on

  Address lookup and geocoding

  Receives: Addresses typed into forms and jobs

If you think you've found a security problem, email support@leadlockai.ai with "Security" in the subject. Please give us a chance to fix it before sharing it publicly, and don't access other people's data while testing. We will reply and keep you updated.