Security

Signed-in requests are scoped to that person’s own client. Database policies call helpers that return the caller’s role and client, not a list of every account. Anonymous visitors do not get those helpers.

A September 2026 pass closed cross-account reads and unbound writes that review found. This page does not describe those defects, and it is not a statement that every query in the product was re-checked on the day you are reading it.

Responses include a Content-Security-Policy. Scripts are limited to this site and a short list of providers the product actually loads, including Stripe, Supabase, and the analytics host. The policy still allows inline scripts, because the app framework and a few embedded tools need them. That is not a strict policy.

Responses also include a Strict-Transport-Security header asking browsers to use HTTPS, including on subdomains. The header contains a preload token. This page does not claim the domain is on a browser preload list.

State-changing requests that are not on the public list are rejected unless the Origin or the Referer matches this site. If neither header is present, the request is rejected. If the production app URL is not configured, those requests are rejected too. Some links that have to work from email, including one-click unsubscribe, are on the public list and skip this check, because mail apps do not send an origin.

When a tenant supplies a URL for the product to fetch, that fetch goes through a check that refuses non-web URLs and blocked hosts. Fetches to services Long Drive already operates are a different path. Not every outbound call in the codebase uses the tenant-URL check.

OAuth tokens are encrypted before they are written, using a key that belongs to that integration. If the key is missing in production, the write is refused rather than stored as readable text. Local development can still store a marked plaintext value. Older rows may still be in an earlier format until they are rewritten.

Inbound webhooks from the providers the product lists are recorded before their side effects, so a repeat delivery is ignored. That list is not every HTTP request the app receives.

An account can pause outbound sends. Dispatch stops before it builds the recipient jobs. A pause is a switch. It does not mean a message cannot be sent by mistake, and it is not a promise about how often mail can go out.

Unsubscribe and preference links work without a login. The token in the link is what authorizes the change. Later sends are supposed to honor that opt-out.

Some privileged actions and some per-tenant actions are written to an activity log. A row exists when that call ran. This is not a claim that every action was written down.

An account owner can request deletion from settings. They confirm from an email. The account is then scheduled for deletion 30 days later, and a daily job performs the purge. You can export leads as CSV from the Leads page before then. The 30 days is that schedule, not a response-time promise.

Customer Intelligence is turned on through managed onboarding. It is not part of public self-serve signup. Profiles are generated from recorded activity. Activity text can include whatever was stored there. This page does not say that names, emails, or phone numbers are always removed before a profile is generated.

Card payments run on Stripe. The database and sign-in run on Supabase. The site is hosted on Vercel. Those are the vendors. Naming them is not a promise about Long Drive Leads, and this page does not give an availability percentage.

Privacy questions: privacy@longdrivegroup.com. Other questions: support@longdrivegroup.com. There is no separate disclosure program and no promised reply window.