Can other LeadClaw users see my data?

No. Row-level security filters every query down to your own rows, and your agent runs on a dedicated server separate from everyone else.

How are my password and API keys stored?

Hashed, one-way, with bcrypt. That covers your login password and any MCP API key you generate. LeadClaw can verify them but can't read them back.

Are my Google Ads or Meta Ads credentials hashed too?

No, they're encrypted instead, with a per-user AES-256 key. Your agent has to decrypt them to actually run your ad campaigns, and hashing would make that impossible.

Does LeadClaw sell or share my data?

No, never, not with third parties and not to train AI models.

Security & Privacy

Your data is isolated by design, and every credential LeadClaw touches is protected the right way for what it's used for. Here's how that actually works.

Data isolation

Row-level security (RLS) sits on every database table. Queries only ever return your own rows, never another customer's.
One agent, one server. Your AI agent runs on its own dedicated VPS, separate from everyone else's.
No shared state. Your agent only talks to the web app through authenticated API calls.

Credential security

Not every credential is protected the same way, because they don't all need to be. Some have to stay one-way forever. Others need to be reversible so the platform can actually use them on your behalf.

Hashed, one-way, never reversible:

Your password, hashed with bcrypt through Supabase Auth
MCP API keys (the lc_sk_ keys you use to connect Claude Desktop or Cursor)

Encrypted, reversible, per-user AES-256 keys:

OAuth tokens for connected accounts
Ad-platform credentials for Google Ads and Meta Ads, since your agent has to decrypt them to actually place ads for you

Sessions expire after inactivity, and every connection runs over HTTPS/TLS.

Infrastructure security

VPS firewall: only ports 443 (HTTPS) and 22 (SSH) are open on agent servers.
Encrypted at rest: database backups are encrypted.
Automated backups: point-in-time recovery with 7-day retention.
Rate limiting: every API endpoint is rate-limited.

Email compliance

Your agent automatically enforces:

SPF, DKIM, and DMARC on every sending domain
CAN-SPAM: a physical address and one-click unsubscribe in every email
GDPR: consent tracking, data export, and the right to deletion
Bounce monitoring: campaigns auto-pause at a 2% bounce rate or 0.1% spam complaint rate

What we don't do

We never sell or share your data with third parties.
We never store passwords in plaintext.
We never use your business data to train AI models.
We never send outreach from your personal address, only from your managed @leadclaw.io address.