Security, data location and GDPR

This article covers what you can do inside LeadLex. The legal documents and the full list of controls are on the website:

• Security and trust for the controls and what each one is worth.
• Data processing agreement, signed with every firm.
• Sub-processors, the companies that process data for LeadLex.
• Privacy policy.

Where your data is stored

Your database is stored in Frankfurt, Germany, in the EU. Each firm has its own workspace and its own Lexi instance, and nothing is shared between firms. Data is encrypted in transit and at rest, including backups.

To answer your questions, Lexi sends requests to AI model providers named on the sub-processors page. Some of them are in the US, and the transfers are covered by the EU-US Data Privacy Framework or Standard Contractual Clauses. Your data is not used to train any model.

On certifications, the infrastructure LeadLex runs on is ISO 27001 certified and SOC 2 Type 2 audited. If your risk team needs the infrastructure certificates or LeadLex's current status, see Security or contact us.

Secure your account

1. Open Settings and choose Security & Privacy.
2. Under Personal Two-Factor Authentication, turn it on. You can use an authenticator app (recommended) such as Google Authenticator, Microsoft Authenticator or Authy, or email-based verification.

If your firm uses single sign-on, sign in with Sign in with SSO and your work email. Workspace admins can see the configured domains under Single Sign-On (SSO).

Settings for workspace admins

Admins see more on Security & Privacy.

• Workspace Security (Admin Only): switch on Require MFA for all users, set a Session timeout and a grace period, and see the Team MFA Status.
• Privacy & Sharing: choose whether Synced emails visible to team, Calendar events visible to team and Contacts shared across team are on. Leave them off to keep a mailbox private to its owner. For a new workspace, the first two are off and Contacts shared across team is on.
• The Activity Log card on the same page shows who did what and when across the workspace. Its Retention period can be set to 90 days, 180 days (the default) or 1 year, and older entries are deleted automatically every night.

Roles control who does what. Members work with contacts, deals, tasks and Lexi. Admins also manage people, billing, API keys and data export. See Create your workspace and invite your team.

Control what connects

• Mailbox and calendar: you connect your own account and can switch each part off, or choose Disconnect. See Connect Gmail or Outlook, and Google Calendar.
• AI assistants: each connection is listed under Connected AI assistants in Settings → API & Data, and you can revoke it. Sending email campaigns through an assistant is off unless an admin turns on Allow AI assistants to send outbound.
• API keys: revoke any key you no longer use. See Create an API key.

Handle a deletion request

When a person asks you to delete their data, a workspace admin can erase it.

1. Open the person's contact record.
2. Open the menu in the header and choose Erase personal data (GDPR). Only admins see this option.
3. Read what will be removed, type the confirmation word and choose Erase permanently.

This removes the contact and their data from LeadLex: notes and tasks about them, activity history, event attendance and campaign enrolments, emails and LinkedIn conversations that involve only them, and links, merge history and audit-log copies. Shared notes, meetings and deals stay, with this person taken out. It cannot be undone.

To tidy a duplicate instead, use Merge. A merge can be undone; an erasure cannot.

Export your data

Admins can export contacts, companies and deals from Settings → API & Data → Import & Export. Under the DPA, the firm can also request deletion of its data when it leaves. The export is a CSV file for each of contacts, companies and deals.

What happens next

If your security team has more questions than this covers, book a technical session.