§01Confidentiality
Physical access control
• Office premises in a building with security service; no access for unauthorised persons.
• Workspaces lockable; documents in lockable cabinets.
• No own server rooms: processing exclusively by hosting providers with data centres in the EU that have their own certified physical access controls.
Logical access control
• All company accounts and admin access are protected with two-factor authentication.
• End devices with password or biometric login (fingerprint/facial recognition); automatic screen lock after 20 minutes at the latest.
• Passwords are managed exclusively in password managers.
• Privacy screens for mobile work; firewall and protection mechanisms of the operating systems active; security updates are installed automatically.
• Access of departing persons is immediately revoked.
Data access control
• Role and rights concept: access to customer data only for the owner and the persons entrusted with operation and development; sales staff only with restricted rights.
• Multi-tenancy separation at database level (row-level security): each customer sees exclusively the data of their own account.
• API access only with customer-specific, revocable keys; keys are stored only as a hash.
Separation control
• Logical separation of data per customer (tenant).
Pseudonymisation / Data minimisation
• lead.box identifies companies, not individual persons; no profiles of private individuals are created.
§02Integrity
Transmission control
• Transmission exclusively encrypted (TLS/HTTPS); webhooks are sent with an HMAC signature.
Input control
• Logging of changes and administrative access (audit log).
§03Availability and resilience
• Daily automatic data backup at the EU hosting provider.
• Hosting on redundant cloud infrastructure in the EU; monitoring of failures and errors.
§04Procedure for regular review
• Regular security audits of the application (including automated security scans, review of access rules).
• Data protection by design and by default.
Instruction control
• Sub-processors are carefully selected and engaged only with a data processing agreement. Insofar as data is processed outside the EU/EEA, this is done only on the basis of an adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework) or the EU Standard Contractual Clauses (Art. 46 GDPR).
• Employees and sales partners are contractually bound to confidentiality.
Incident management
• Data breaches are reported to the customer without undue delay, at the latest within 72 hours of becoming aware of them.
Deletion concept
• Termination of the plan ends the collection of data; the account remains until a deletion request is made.
• Upon the customer's request, the account and all associated data will be deleted within 30 days.