All traffic to LeadSight is encrypted in transit over HTTPS. Sensitive data, including your Xero connection tokens, is also encrypted at rest using AES-256-GCM.
Every account's data is isolated — requests are verified against your account on every call, so another customer's data is never accessible through LeadSight.
LeadSight is hosted on SOC 2-compliant infrastructure, with rate limiting on sign-in and data-export endpoints, and strict protections against common web attacks like XSS and CSRF.