Database storage
Lead information is stored in PostgreSQL through Prisma. The production database should require encrypted connections, strong credentials, least-privilege access, and separate environments for development, staging, and production.
Data security
Secure storage of lead information
This page describes the security practices expected for storing and operating business lead data in the MVP.
Last updated: July 20, 2026
Transport security
The production site should be served only over HTTPS. Lead forms submit data to the server API over encrypted transport, and database connections should use SSL requirements from the hosting provider.
Access control
Only authorized operators should have access to lead records, database consoles, deployment settings, and email notification accounts. Shared credentials should be avoided, and access should be removed when no longer needed.
Secrets management
Database URLs, Resend API keys, and email settings must stay in environment variables and should never be committed to source control. Rotate secrets immediately if they are exposed.
Email handling
Email notifications should include only the information needed to process a lead. Avoid sending highly sensitive medical records through email, and consider reducing message detail if operational needs allow.
Operational safeguards
Before launch, enable provider security features such as two-factor authentication, audit logs where available, database backups, spam protection, rate limiting, and a deletion workflow for old or requested-to-delete leads.