lemonreach runs on Amazon Web Services in the European Union. Our primary infrastructure, including the database and file storage, is in the AWS Frankfurt region, and AI processing runs in AWS regions within the EU. Your data is not used to train AI models.

• All data is encrypted in transit with TLS (HTTPS) and encrypted at rest.
• Credentials for the tools you connect, such as mailbox access tokens and API keys, are additionally encrypted at application level with AES-256-GCM before they are stored.

• Sign-in is handled by Amazon Cognito, a managed identity provider, with the option to sign in with Google.
• Data is separated per customer account, and each account has roles (account admin, admin, user) that control who can manage the account and its integrations.
• Internal access to customer data follows least privilege and need-to-know. Any support access to a customer account is logged.

• Request validation, rate limiting, and security headers protect our API.
• When lemonreach fetches company websites, requests to internal and private networks are blocked.
• Changes are tested with automated tests and type checking before they are released.

The browser extension is optional. It only connects a LinkedIn account to lemonreach after the user agrees on its consent screen. LinkedIn session cookies stay in the user's browser and are not stored on our servers. We keep only a connection record, including a one-way hash of the session cookie, which is deleted when LinkedIn is disconnected, the extension is signed out or uninstalled, or the extension has not checked in for 14 days. See Section 3.5 of our Privacy Policy.

We use a small number of sub-processors, each bound by a written data processing agreement. They are listed in Annex 2 of our Data Processing Agreement, and we give notice before adding or replacing one.

Campaigns are deleted automatically at the end of your plan's campaign storage period, and customer data is deleted within 90 days of termination. Details are in Section 11 of our Data Processing Agreement.

We monitor our systems for security events. If a personal data breach affects data we process on your behalf, we notify you without undue delay and within 48 hours, as set out in Section 9 of our Data Processing Agreement.

If you believe you have found a security vulnerability in lemonreach, please email [email protected] with the details. Please give us reasonable time to fix the issue before disclosing it publicly.