Access that follows your workspace.

A practical description of the controls in the LiveLead pilot. These are product controls, not a claim of security certification.

Accounts and boundaries

Google sign-in requires a verified email. Invited members must sign in with that email. Workspace authorization is checked on each request. Owners manage setup, billing and team access; representatives work with leads and their own alert preferences. Platform administration is limited to configured admin accounts. Removing workspace access blocks subsequent workspace requests.

Data and credentials

LiveLead uses HTTPS, server-side sessions, same-origin request checks and private database access. Integration secrets are encrypted at rest and are not returned to the browser. Recording playback requires workspace authorization and is proxied through the server. Do not share account access; use individual team invitations and secure your Google account.

Calling and spending controls

Live calling has a server-side switch and pilot number restrictions. Receptionist usage is reserved before calls start so concurrent calls share a bounded allowance. Extra usage requires opt-in and a cap. Signed provider callbacks and idempotency checks protect call and billing updates. Trial overages and pilot extra-usage invoice collection are disabled.

Limitations and reporting

No phone or AI service is infallible. Retain a carrier fallback for outages. The pilot does not offer a contractual uptime or security certification. To report a suspected security issue, email brock@clickflow.dev with a description and affected workspace, without attaching secrets or unrelated customer data.