# Security, data location and GDPR > Where your data is stored, how to secure your account and workspace, how to handle a deletion request, and where to find the DPA and sub-processor list. Source: https://www.leadlex.com/help/account/security-data-location-gdpr Last updated: 2026-10-23 This article covers what you can do inside LeadLex. The legal documents and the full list of controls are on the website: - [Security and trust](/security) for the controls and what each one is worth. - [Data processing agreement](/dpa), with a countersigned copy available on request. - [Sub-processors](/subprocessors), the companies that process data for LeadLex. - [Privacy policy](/privacy). ## Where your data is stored Our primary Supabase database, authentication service, Storage objects and database backups are in Frankfurt, Germany. Fly.io agent volumes in our current Frankfurt pool are encrypted, with automatic snapshots configured for five-day retention. Fly stores those snapshots in the United States. Frankfurt compute therefore does not mean that all copies or processing remain in the EU. AI, support, telemetry and delivery services may involve other countries, as described in our [sub-processor list](/subprocessors). We do not use Customer Data to train our own general-purpose AI models. Provider training restrictions, retention and exceptions depend on the commercial account, endpoint and feature used. Commercial no-training terms do not mean zero retention. We do not represent that zero-data-retention settings are enabled across our services. The [AI Policy](/ai-policy) describes the processing scope; deployment-specific requirements must cover fallback providers and connected tools as well as the primary model. We are preparing for ISO/IEC 27001 certification and a SOC 2 examination. We do not yet hold either assurance, and supplier reports do not certify LeadLex. See [Security](/security) for current scope. ## Secure your account 1. Open **Settings** and choose **Security & Privacy**. 2. Under **Personal Two-Factor Authentication**, turn it on. You can use an authenticator app (recommended) such as Google Authenticator, Microsoft Authenticator or Authy, or email-based verification. If your firm uses single sign-on, sign in with **Sign in with SSO** and your work email. Workspace admins can see the configured domains under **Single Sign-On (SSO)**. ## Settings for workspace admins Admins see more on **Security & Privacy**. A displayed setting is not proof of enforcement across every route. Agree and verify the required MFA, session and sharing behaviour before relying on it for restricted data. - **Workspace Security (Admin Only):** switch on **Require MFA for all users**, set a **Session timeout** and a grace period, and see the **Team MFA Status**. - **Privacy & Sharing:** choose whether **Synced emails visible to team**, **Calendar events visible to team** and **Contacts shared across team** are on. Configure these controls to match your sharing instructions. Restricted mailbox or matter access must also be validated across AI, API and connected-service routes before confidential use. For a new workspace, the first two are off and **Contacts shared across team** is on. - The **Activity Log** card on the same page shows who did what and when across the workspace. Its **Retention period** can be set to 90 days, 180 days (the default) or 1 year, and older entries are deleted automatically every night. Roles control who does what. Members work with contacts, deals, tasks and Lexi. Admins also manage people, billing, API keys and data export. See [Create your workspace and invite your team](/help/getting-started/create-workspace-and-invite-team). ![Security and Privacy settings for admins](/help/security-data-location-gdpr/security-settings.webp "Security & Privacy in Settings, as an admin sees it.") ## Control what connects - **Mailbox and calendar:** you connect your own account and can switch each part off, or choose **Disconnect**. See [Connect Gmail or Outlook, and Google Calendar](/help/getting-started/connect-email-and-calendar). - **AI assistants:** each connection is listed under **Connected AI assistants** in **Settings → API & Data**, and you can revoke it. Sending email campaigns through an assistant is off unless an admin turns on **Allow AI assistants to send outbound**. - **API keys:** revoke any key you no longer use. See [Create an API key](/help/ai-and-api/create-an-api-key). ## Handle a deletion request When a person asks you to delete their data, a workspace admin can erase it. 1. Open the person's contact record. 2. Open the menu in the header and choose **Erase personal data (GDPR)**. Only admins see this option. 3. Read what will be removed, type the confirmation word and choose **Erase permanently**. The erasure action addresses the contact and linked CRM records: notes and tasks about them, activity history, event attendance and campaign enrolments, emails and LinkedIn conversations that involve only them, and links, merge history and audit-log copies. Shared notes, meetings and deals stay, with this person taken out. Treat this action as irreversible. It does not by itself establish deletion from agent memory, provider systems, logs or backups. Contact us to coordinate a complete request under the DPA. To tidy a duplicate instead, use **Merge**. A merge can be undone; an erasure cannot. ## Export your data Admins can export contacts, companies and deals from **Settings → API & Data → Import & Export**. Under the DPA, the firm can also request deletion of its data when it leaves. The export is a CSV file for each of contacts, companies and deals. ## What happens next If your security team has more questions than this covers, [book a technical session](/contact).