Integrity Leads — Security Overview

Executive Summary

Integrity Leads operates embedded auto finance application forms on behalf of franchised dealerships and financing partners. This document summarises the technical, organisational, and compliance controls applied to the collection, transmission, storage, and deletion of applicant data. It is intended for procurement, IT security, and compliance teams evaluating our platform.

AES-256

Encryption standard

99.99%

Cloudflare uptime SLA

90 days

Lead data retention

<50ms

Edge response time

Infrastructure & Hosting

Cloudflare Workers (Edge Compute)

All application logic executes on Cloudflare's global edge network across 300+ data centres. No origin server to compromise. Cloudflare holds SOC 2 Type II, ISO 27001, and PCI DSS certifications.

Cloudflare D1 & KV (Encrypted at Rest)

Lead backups in D1; queue and rate-limit state in KV. SSNs and raw sensitive fields are stripped before any database write. All Cloudflare storage is encrypted at rest by default.

No Dedicated Origin Server

The platform has no persistent VM or container. Attack surface is limited to the Worker edge runtime — no SSH access, no exposed database port, no persistent file system to exfiltrate.

TLS 1.3 Enforced in Transit

All client-to-edge and edge-to-backend communications encrypted with TLS 1.3 minimum. HSTS enforced with one-year max-age on all hosted endpoints.

Automatic Retry & Lead Recovery

Undelivered leads queue in KV for 7 days with automatic retry every 5 minutes (up to 24 attempts). All leads remain recoverable from D1 backup for 90 days regardless of downstream processor status.

90-Day Data Retention Policy

Lead records are automatically pruned after 90 days via a scheduled cron job. Analytics events are retained for 180 days. Erasure audit logs are retained indefinitely (email hash only, no PII).

Data Handling & Encryption

SSN / ITIN Handling

Social Security Numbers are accepted for credit application purposes only. They are transmitted over TLS, forwarded to the dealer's configured endpoint, and are never written to logs, analytics systems, or backup databases. The D1 backup schema explicitly excludes SSN columns. An audit flag is set to indicate a credit-class submission without storing the value itself.

Data Field	Transmitted	Logged	Stored (D1)	Retention
Full name, email, phone	Yes (TLS)	No	Yes	90 days
Address, DOB, income	Yes (TLS)	No	Yes	90 days
SSN / ITIN	Yes (TLS)	No	No — excluded	Not stored
IP address	Yes	No	Yes	90 days
Consent text & version	Yes	Yes	Yes	90 days
Analytics events	Yes	No	Yes	180 days
Erasure audit log	N/A	Yes	SHA-256 hash only	Indefinite

Application Security Controls

Per-Client Origin Validation (CORS)

Every inbound request validated against a registered origin allowlist. Requests from unlisted domains rejected at the edge before any processing occurs. Subdomain patterns supported via root-domain extraction.

Rate Limiting — Submissions

5 submissions per IP per hour enforced via Cloudflare KV atomic counters. Exceeding the limit returns HTTP 429 with no data processing. Separate counters for analytics (60/hr) and erasure (5/hr).

Honeypot Bot Detection

A hidden form field (_hp) is validated server-side on every submission. Any submission where this field is populated is silently dropped — no error returned to the requester, no processing triggered.

Content-Type & Body Size Enforcement

All POST endpoints require Content-Type: application/json, blocking browser-form CSRF. Request bodies capped at 64 KB, preventing JSON bomb and memory-exhaustion attacks.

Webhook Authentication

All outbound deliveries include an X-Webhook-Secret header containing a 256-bit random secret stored as an encrypted Worker secret. Never hardcoded in source or config files.

Input Validation & Sanitisation

All fields validated server-side: email format, phone E.164, SSN pattern, DOB age-check (≥18), lat/lng numeric range. consentDomain sanitised before interpolation. Emails normalised to lowercase before storage.

Deduplication

A fingerprint of each submission is stored in KV with a 1-hour TTL. Duplicate submissions within the window are idempotently accepted (HTTP 200) but not re-delivered or re-stored, preventing duplicate leads in dealer CRM systems.

Client-Side Security

The form embed (ilds-form.js) loads on the dealer's website as a standard script tag. The following controls apply to the browser-side component:

No API Credentials in Bundle

Zero API keys, secrets, or credentials included in the publicly distributed JavaScript bundle. All third-party API calls (Google Places, geocoding) are proxied through the Worker using server-side secrets.

AES-256-GCM Draft Encryption

In-progress form data persisted to localStorage using AES-256-GCM encryption via the Web Crypto API. If the encryption subsystem is unavailable, the form fails hard — no plaintext fallback is permitted.

SSN Excluded from Draft Persistence

The SSN field is explicitly excluded from the localStorage draft save set. It is held only in component state and cleared on session end or page close — never written to disk.

Security Response Headers

All Worker-served pages include Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and HSTS on all responses.

Regulatory Compliance

FCRA Compliant

TCPA Compliant

CCPA / CPRA Ready

GLBA Aware

SOC2-Ready Infrastructure

Regulation	Relevance	How We Address It
FCRA	SSN collected; credit report may be pulled	Explicit consent checkbox with FCRA notice. Hard-pull disclosure included. Versioned consent text (v2026-03) timestamped server-side on every submission.
TCPA	Phone number + consent to contact	Opt-in language includes "message and data rates may apply" and confirms consent is not a condition of financing. Checkbox is unchecked by default.
CCPA / CPRA	California resident applicants	Right-to-erasure mechanism live at embed.integrityleads.io/erase. Automated deletion from D1 and KV queue within the request flow. SHA-256 audit log maintained.
GLBA	Non-public personal information (NPI)	Data minimisation: only fields required for financing are collected. SSN not logged. Downstream transmission limited to the dealer's configured endpoint only.

Consent Architecture & Audit Trail

Every form submission produces an immutable consent record. The following fields are captured server-side and cannot be altered by the client:

Consent versionSemantic version string (e.g. v2026-03) stamped by the Worker, not the browser.

Consent textFull verbatim text of the consent paragraph displayed to the user at submission time.

Submitted atUTC ISO-8601 timestamp generated server-side. Client clock cannot influence this.

IP addressOriginating IP captured at the Worker edge. Cannot be spoofed via form payload.

Form typepre_qualification or credit_application — determined by submission path, not client input.

Dealer domainThe origin domain from which the submission was made, validated against the allowlist registry.

Right-to-Erasure (CCPA / GDPR-aligned)

Applicants may submit a deletion request at embed.integrityleads.io/erase. On receipt, the Worker automatically deletes all matching D1 records and purges any queued KV entries for that email address. An erasure audit log entry is written containing only the SHA-256 hash of the email (not the plaintext), the timestamp, and the number of records deleted. The requesting dealer is notified via email for downstream CRM cleanup.

Vendor & Sub-Processor Summary

Vendor	Role	Data Processed	Certification
Cloudflare, Inc.	Edge compute, KV, D1, CDN	All applicant data in transit and at rest	SOC 2 Type II, ISO 27001, PCI DSS
n8n (self-hosted)	Workflow automation, lead routing	Full lead payload (incl. SSN in transit)	Self-hosted on client-controlled infrastructure
SendGrid (Twilio)	Transactional email notifications	Name, email address only	SOC 2 Type II, ISO 27001
Google Cloud	Places autocomplete, geocoding proxy	Address strings only — no PII	SOC 2 Type II, ISO 27001, PCI DSS

Access Control & Credential Management

Secrets Management

All secrets (API keys, webhook tokens, GA4 credentials) stored as encrypted Cloudflare Worker Secrets via Wrangler. Never present in source code, wrangler.toml, or version control history.

Principle of Least Privilege

Each API key is scoped to minimum required permissions. Google geocoding key restricted to Geocoding API only. Webhook secret is a single-purpose 256-bit random value with no other access grants.

No Persistent Admin Sessions

The Worker runtime is stateless. No admin dashboards, persistent login sessions, or cookie-based authentication surfaces exposed to the internet.

Deployment via Wrangler CLI Only

Production deployments made via the authenticated Wrangler CLI only. No in-browser code editing or unauthenticated deployment path exists.

Incident Response & Business Continuity

In the event of a confirmed or suspected data security incident affecting applicant data processed by Integrity Leads, the following response procedure is followed:

1. Detect & Contain Cloudflare anomaly alerts, KV rate-limit spikes, and n8n failure notifications serve as primary detection signals. Affected Worker routes or KV namespaces can be taken offline within minutes via Cloudflare dashboard without a code deployment.

2. Assess Determine scope: which data types, which client IDs, which time window. D1 audit logs and Cloudflare Analytics provide the primary evidence base.

3. Notify Affected dealer partners notified within 72 hours of confirmed breach discovery (aligned with GDPR / CCPA notification windows). Notification includes scope, data types affected, and remediation steps taken.

4. Remediate Rotate affected secrets, patch the responsible code path, re-validate controls. Cloudflare's rollback capability allows reversion to a previous Worker version within seconds if a deployment introduced the vulnerability.

5. Post-Incident Review Written root-cause analysis completed within 14 days. Findings logged in the incident register. Controls updated as required.

Zero Lead Loss Guarantee

The Cloudflare KV queue retains undelivered leads for 7 days with automatic retry every 5 minutes (up to 24 attempts). If all retries are exhausted, an alert email is dispatched to the platform operator. All leads remain recoverable from D1 backup for 90 days regardless of downstream processor status.

Security & Compliance Contact

Security enquiries ryan@integrityleads.io

Privacy / erasure requests embed.integrityleads.io/erase

General embed.integrityleads.io

This document reflects controls in place as of March 2026. Integrity Leads conducts periodic internal reviews of all security and compliance controls. Dealer partners may request an updated copy at any time by contacting the address above. This document is provided for informational purposes and does not constitute a legal representation or warranty.