Security
How we keep your information safe
Last updated October 24, 2026
We're a small team, so we keep things simple: collect little, lean on companies that do security for a living, and lock down what we run ourselves.
Payments
Payments run on Stripe's checkout page. Your card number goes straight to Stripe and never touches our servers. Stripe is certified to the payment card industry's highest security level (PCI DSS Level 1).
Your campaign link
Your campaign page opens with a private link that is signed by our server, so it can't be guessed or changed. Anyone who has the link can see your campaign, so keep it to yourself. If you think someone else has it, email us: we send you a new link and the old one stops working.
Connections and storage
- Every page and form uses an encrypted connection (HTTPS).
- Our database and files are stored with Supabase, encrypted at rest. Only our server can reach the database.
- Forms are rate-limited to slow down bots and abuse.
- Our website scan only reads public pages, refuses private network addresses, and never logs in anywhere.
Collecting less
We never have homeowners' names for Town mailings, we don't keep who scanned your QR code, and we don't run ad trackers. What we don't have can't leak.
Found a problem?
Email hello@handylead.ca with "Security" in the subject. We answer within 1 business day and fix real problems fast. Please don't test against other people's campaigns.