Security and data

Your leads are people. We treat their data that way.

What Streakstone stores, where it is kept, who on your team can see it, and how long we keep it.

Where data lives

Stored in India, encrypted where it matters.

Stored in IndiaLead and account data is kept in a database in Mumbai. The app itself runs in the Mumbai region.
Encrypted in transitEvery page and every connection to Streakstone uses HTTPS.
Keys and tokens encrypted at restThe Meta, WhatsApp, Google and CRM keys you connect are encrypted with AES-256-GCM before they are stored.
Passwords never storedOnly a salted scrypt hash of each password is kept. Sessions use signed, HTTP-only cookies.
Messages checked at the doorWebhooks from Meta and WhatsApp are checked against their signature before anything in them is read.

Who can see what

Each person sees only their jobOwners see everything, managers see leads and settings, reps see their own leads, the front desk sees appointments and check-in.
Agencies see only their clientsAn agency's login reaches the workspaces it runs, and a client never sees another client.
Every step written downActivity shows each test, message, call and delivery for every lead, and a log keeps sign-ins and changes made in the workspace.

What we keep

Nothing deleted by a testA lead that fails a check is held for a person to review, never thrown away.
STOP is finalAnyone who replies STOP is never messaged or called again by Streakstone.
Deleted when you leaveWhen a workspace closes, its lead data is deleted within 30 days. A business can ask us to delete one lead or all its data at any time.
Your leads, your decisionsUnder India's DPDP Act the business decides how its leads' data is used; Streakstone processes it on the business's instructions.

Service providers

The providers that run parts of Streakstone, what each one gets, and where, are listed in the privacy policy.

Legal