Security at LeadMighty

You're trusting LeadMighty with some of your most sensitive records — salaries, identity documents, health-related leave. We design the product so that data stays private, access is earned, and every action is accountable.

Every organisation's data is scoped to its own workspace and separated from every other tenant. Enterprise customers can go further with a dedicated, single-tenant deployment on their own database and domain.

Inside a workspace, role-based permissions decide exactly what each person can see and do. Sensitive fields — compensation and payslips — are gated to the people who should see them, enforced on the server, not just hidden in the interface.

• Granular roles and permissions, configurable per organisation.
• Server-side enforcement on every request, so the rules can't be bypassed from the client.
• Least-privilege access for LeadMighty staff, granted only when needed for support.

Data is encrypted in transit using modern TLS, and encrypted at rest by our infrastructure providers. Files you upload are stored in access-controlled object storage.

We build on reputable cloud infrastructure with managed backups and redundancy. Our providers maintain recognised security certifications; details are available to customers under NDA.

• Changes go through review and automated checks before release.
• Secrets and credentials are kept out of source code and rotated when needed.
• We monitor for unusual activity and keep audit trails of sensitive actions.

Security is shared. Use strong, unique credentials for your admins, review who has access regularly, and off-board people promptly. The product gives you the controls; you decide how tightly to set them.

Found something? We want to hear from you. Email security@leadmighty.com with the details and steps to reproduce, and we'll respond quickly. Please give us reasonable time to fix an issue before disclosing it publicly.