LeadArivo security

Website and enquiry controls

• HTTPS with HSTS when the site is served over HTTPS
• Content-Security-Policy, X-Frame-Options DENY, nosniff, Referrer-Policy and a restrictive Permissions-Policy
• Validated enquiry forms, honeypot field, submission size limits, one-time challenge tokens and optional Cloudflare Turnstile
• Enquiry submissions are accepted only when the production inquiry pipeline is enabled for the deployed origin
• CMS preview cookies are httpOnly and SameSite=strict

LeadArivo product principles

The product revision inspected on 4 October 2026 uses opaque random server-side sessions stored as hashes, with expiry and logout revocation, rather than application access JWTs. Session cookies use HttpOnly and SameSite controls; Secure transport settings apply in the supported Production configuration. The inspected revision is not proof of the deployed Production build or settings.

LeadArivo is designed as a multi-tenant product with account and permission boundaries. Selected local isolation tests provide evidence for the tested paths, not a guarantee that every Production route, worker or provider has been verified.

Integration credentials receive application-level encryption in the inspected implementation. Most customer message and CRM content is stored in ordinary database fields in that revision. Disk/database encryption, object storage, backups, restore testing and key-management controls require separate Production evidence. No universal content-encryption or zero-staff-access guarantee is made.

Supported automations may assign work, create follow-ups and notify the team. They do not send customer messages on their own. Human-required actions stay visible on the lead.

What we do not claim

This page does not display SOC 2, ISO 27001, HIPAA, PCI DSS, “GDPR Certified”, CSA STAR or similar badges. TEAL Infotech has not published those certifications for LeadArivo on this website.

Disk/database encryption at rest, backup encryption and restoration tests, managed key custody (KMS), full customer-content field encryption, 24/7 SOC monitoring and named Production cloud regions remain unverified. Planned controls are not presented as deployed controls.

Report a security issue

Found a potential security issue? Report it responsibly. Do not exploit it beyond what is needed to demonstrate the issue.

Go to Responsible Disclosure or email info@leadarivo.com with the subject line “Security report”.