Reporting a vulnerability
Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.
The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.
Accounts
LeadGrade has user accounts. What is stored against one, and who else touches it, is below.
What is stored
- Your account: the email address you sign in with, and the forms and CRM you connect
- Every inbound lead the agent reads — what the person told your form, what the agent enriched it with, and how it ranked them
- Every draft reply and writeback the agent proposed and every decision you made on it, because that record is what makes the kill window provable rather than asserted
- Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings
Who else processes data
- Supabase — authentication and the database holding your leads, their scores and your decision history
- HubSpot — where a lead is read from and a writeback you approved is posted, under the access you granted
- PostHog — anonymous product analytics, proxied through this domain
- Vercel — serves this site and holds its access logs
Also true
- The plans are PRO at $9/month. There is no free tier — the live demo at /demo runs the real scoring engine and needs no account.
- Nothing is written back to your CRM and no reply is sent without you approving that specific action first. Approval is per action, not a setting you turn on once.
- There is no payment processor in the list above because this repo has no checkout route at all — a build gate re-checks that rather than believing it.
- Every action the agent takes is written to an append-only ledger with the evidence it acted on, including the ones nobody looks at. That record is what makes the kill window provable rather than asserted.
- There is no password on this product. Sign-in is a link sent to your email address, so there is nothing to reuse, leak or reset badly.
- Your data is scoped to your organisation at the database level, not only in the interface.
LeadGrade is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.
