Leaderful has no passwords. Each time you sign in, we email a one-time code to your address and you enter it in the app. There is nothing to reuse, guess or expose in a breach of another service.

Strictly, this is a single factor: possession of your inbox. In practice it means access to Leaderful is protected by whatever protects your email, including any multi-factor authentication you or your employer enforce there. Sessions are issued by our identity provider as short-lived signed tokens.

Not yet. Enterprise SSO (SAML and OIDC) is on our roadmap. Today everyone signs in with the emailed code described above.

Members of an organization use the same iOS, Android and web apps as everyone else. Organization admins have an additional dashboard for inviting members and viewing team insights, gated by their admin role. Admin actions are verified on our servers against the organization’s membership, not just in the app. If your IT team restricts outbound traffic, see the Pre-Enrollment IT Checklist for the domains to allow.

Not at present. Leaderful runs on Amazon Web Services, and the specialist providers we rely on for identity, payments and support each hold their own SOC 2 or ISO 27001 certifications, which we can point you to on request. The rest of this collection describes the controls we operate ourselves.

All connections use TLS. Databases, file storage and backups are encrypted at rest with AWS-managed encryption, and particularly sensitive fields are encrypted again at the application level. A web application firewall and request rate limits sit in front of our API. Secrets are held in encrypted configuration, never in code.

A small number of named engineers, each with multi-factor authentication on their accounts.

We will notify affected customers without undue delay and no later than 48 hours after confirming an incident that affects their data, with what we know at that point and follow-ups as the investigation continues. For organizations, notice goes to the named admin contact.