Your Data. Your Book. Never Resold.
You’re trusting a lead vendor with your book of business. Here’s exactly how InsureLeads CRM keeps it walled off, encrypted, and yours — in plain language, with no security theater.
InsureLeads CRM keeps every organization’s data walled off from every other org — your leads, contacts, and call history are never pooled, shared, or resold to other agents. Every credential you connect, like Twilio or your calendar, is encrypted per-org before it touches the database. It’s your data, your book of business, on your terms.
Published · Last updated
Three promises about your data
Not a policy PDF — the three things that actually decide whether your book is safe, and what makes each one true in the product.
- Never resold. Your leads and client records are never pooled, shared, or sold to another agent. We are a lead vendor, but the book you build in the CRM is yours — not inventory we recycle.
- Walled off per organization. Every lead, contact, message, and booking is tagged to your organization. The app scopes every query to your org, so no other account can read your data.
- Encrypted where it counts. The credentials you connect — your Twilio account and your calendar — are sealed in a per-org encrypted vault using AES-256-GCM, with the master key kept out of the database entirely.
Is my data safe? The honest answers
Every answer maps to something real in how the product is built — no badges, no hand-waving.
What “never resold” actually means
It is a fair worry: if a lead vendor also runs your CRM, what stops them from recycling the book you build? Here is the line we draw. InsureLeads sells fresh, exclusive leads to you — sold once, to one buyer. The contacts and pipeline you then grow inside the CRM are a different thing entirely: they are your records, tagged to your organization, and there is no product path that pools them back into inventory or sells them to another agent.
Put simply: we compete on generating new leads well, not on reselling the ones you already earned. That is why the leads we sell — like exclusive final expense leads — are priced as exclusive in the first place.
How your connected accounts are locked down
When you connect your own Twilio number for calls and texts, or link your Google or Outlook calendar, those credentials are the crown jewels — so they get their own encryption. Each organization's connected-account tokens are sealed with AES-256-GCM before they are written to storage. The key that unlocks them is itself wrapped by a master key that lives only in the server environment and is never stored in the database. In practice: a database on its own does not reveal your connected accounts.
- Per-organization keys. Encryption is scoped per org — your vault is not the same as anyone else's.
- Named, not blanket. We tell you it's your Twilio and calendar credentials that are encrypted, rather than claiming “everything is encrypted.”
- App-level isolation. Every query is scoped to your organization's ID — honest framing, not a certification badge.
For the formal, legal treatment of what we collect and why, see our privacy policy.
Take your book with you
Your data is portable because it is yours. Bringing a list in is self-serve today: CSV import maps your columns to the right fields and skips duplicates on the way in, so you are never locked out of your own records to begin with. And there is no contract clause that traps your book — if you want a full copy of your data to leave, contact us and we will provide it.
Questions about your data specifically? Reach the team — or start on the free plan and see it for yourself before you connect anything.
Your Data & Privacy — FAQs
No. The book of business you build in InsureLeads CRM is never pooled, shared, or resold to another agent. Every lead and contact is tagged to your organization, and there is no feature that hands one organization’s records to another. InsureLeads sells fresh, exclusive leads to you — it does not resell the ones already in your pipeline.
Your data is scoped to your organization: every query the app runs filters to your org ID, so other accounts cannot see your leads, contacts, or pipeline. The sensitive credentials you connect — your Twilio account and your calendar — are stored in a per-organization encrypted vault (AES-256-GCM), with the master key held in the server environment and never written to the database. We keep the description plain on purpose and do not claim certifications we do not hold.
No. Isolation is enforced at the application layer: every read and write is scoped to the organization you belong to, using the org ID carried on each record. One agency’s data is invisible to every other agency on the platform.
The credentials for the accounts you connect. When you link your own Twilio number or your Google/Outlook calendar, those tokens are encrypted per-organization before they are stored, using AES-256-GCM with a key that is wrapped by a master key kept only in the server environment. We name what is encrypted rather than claiming a blanket "everything is encrypted."
Your book is yours to take. You can bring your existing list in with CSV import (column mapping plus duplicate skipping), and your leads, contacts, and notes remain your property while you use the CRM. To take a full copy of your data out, contact us and we will provide it — there is no lock-in clause holding your book hostage.
Not yet — and we will not claim one we do not have. This page describes exactly how isolation and encryption work in the product today, in plain language, so you can judge it on the mechanics rather than a badge. As formal certifications are completed, they will be published here.
No. Buying leads and using the CRM are separate. If you stop running a lead campaign, the leads and contacts already in your account stay yours on whatever plan you are on. See CRM pricing for how the Free and Pro plans work.