How LQT protects your data
Last updated: 21 July 2026
This page is written for the people who have to say yes before LQT can be used at a company: IT admins, security reviewers, and procurement. It documents exactly what LQT can access, where data lives, and what happens if something goes wrong. If your team needs the short printable version to allowlist the app, see LQT for IT Administrators.
Email access is send-only — we cannot read your inbox
LQT connects to Gmail or Outlook using OAuth with the narrowest scopes that let it send email on your behalf. It never requests, and technically cannot use, permission to read, search, or import your mailbox.
- Google:
gmail.send(send mail only) +userinfo.email(confirm which address connected). Nogmail.readonly, nogmail.modify. - Microsoft:
Mail.Send(send mail only) +User.Read(basic profile) +offline_access(stay connected without re-login). NoMail.Read, no directory or calendar access.
The exact client IDs and scopes are listed on the IT Administrators page, so your admin can verify what's requesting access before approving it.
Encryption and isolation
- In transit: every connection to LQT (web app, API, email OAuth callbacks) is HTTPS/TLS. There is no unencrypted path.
- At rest: data is stored in Supabase's managed Postgres, encrypted at rest. OAuth tokens are stored in Supabase Vault (encrypted secret storage), never in a plain database column.
- Per-company isolation: LQT is multi-tenant. Every table that holds business data (leads, quotes, rates, shipments) is protected by Postgres row-level security tied to your company — one company's users cannot query another company's rows, enforced at the database layer, not just in application code.
Subprocessors — who else touches the data
LQT is built on a small number of established infrastructure providers. We don't sell data to anyone, and we don't use it for advertising.
| Provider | Role | What it sees |
|---|---|---|
| Supabase | Database, authentication, file storage, backend functions | All application data (this is where LQT is hosted) |
| Vercel | Hosts the web app front end | Static app code only — not your business data |
| Cloudflare | DNS and inbound email routing for supplier replies | Routes incoming reply emails to LQT for processing |
| Anthropic (Claude API) | Reads a single supplier reply email to extract rate figures | Only the reply email you received, not your wider mailbox |
| Resend | Sends sign-in, password-reset and notification emails | The address the message goes to and the message itself — not your business data |
| PostHog (EU) | Product usage statistics, so we can see which features earn their place | Which screens were opened and that an action happened, with your account and company id — never client names, lanes, prices or anything you type |
AI processing, specifically
When a supplier replies to a quote request, that single reply is sent to Anthropic's Claude API to extract rate and container details into structured data. Per Anthropic's API terms, content sent through the API is not used to train models. LQT does not send your full mailbox, CRM data, or any email you haven't explicitly routed through the quote workflow.
Data residency
LQT currently runs on a single Supabase project on AWS-backed infrastructure. Supabase's core infrastructure is SOC 2 Type II audited. We do not yet offer a choice of hosting region — if your organization has a specific data-residency requirement (EU-only, for example), contact us below before onboarding so we can confirm whether it's a fit.
Retention and deletion
Any user can export a full copy of their data or permanently delete their account and all associated data, self-service, from Settings — no ticket or waiting period required. Deleting a connected inbox revokes LQT's send permission immediately. Details are in the Privacy Policy.
Honest status: where we are today
LQT is in beta. We follow the practices above today, but we have not yet completed third-party certification. Specifically, as of this page's last update:
- Google OAuth app verification and Microsoft Publisher Verification are in progress, not yet complete.
- We do not yet hold a SOC 2 or ISO 27001 certification of our own (Supabase, our infrastructure provider, does).
- We do not yet have a formal, tested incident-response runbook beyond direct founder response — if you report an issue, you will hear from a human, not a support queue.
We'd rather tell you this plainly than overstate it on a page like this one.
Report a security issue
Found a vulnerability or have a security question? Email support@leadquotetrack.com directly — it goes to the founder, not a queue.