How Leads Connect protects agency credentials, client marketing assets, and tenant isolation at every layer.
AES-256-GCM Credential Vault
All Meta OAuth access tokens and client secrets are encrypted at rest using AES-256-GCM authenticated encryption. Each encryption operation generates a unique 12-byte initialization vector (IV) and a 16-byte authentication tag to detect any tampering attempts.
Zero Token Exposure
OAuth tokens are strictly held in the server-side Credential Vault. Tokens are NEVER passed to client-side JavaScript, never stored in browser localStorage, never rendered in HTML, and strictly scrubbed from structured loggers and error tracking systems.
Strict Multi-Tenant Isolation
Tenant boundaries are enforced at the service and database query layer. Organization identifiers are determined exclusively from cryptographically signed server sessions—never from client request parameters. Automated integration test suites continuously verify cross-tenant boundaries.
No Password Storage for Platforms
Clients never provide their Meta or Facebook passwords. All authentication occurs directly on Meta's official OAuth dialogs (`dialog/oauth`), ensuring clients retain 100% ownership and can revoke access anytime in Meta Business Settings.