Security

Ledion moves your contacts’ details from HubSpot to your ad networks, so it’s built to keep as little as it can. For your contacts’ data, Ledion is a processor: it acts on your instructions. The terms are in the data processing agreement, and the companies involved are on the subprocessors page.

What Ledion never stores

Your contacts’ email addresses, phone numbers, names, addresses, IP addresses, browser details and ad click IDs are never written to Ledion’s database, queues, logs or error messages. Not as plain text, and not hashed.

When a workflow runs the step, Ledion reads what it needs from HubSpot, normalizes it, hashes it, sends it to the network and drops it. All it keeps is which kinds of detail were there, like “email yes, phone no”, so Activity can show why a network did or didn’t match.

• Messages from networks are cleaned before Ledion stores or shows them: anything that looks like an email address, a phone number, a token or a long ID is removed, and the text is cut to 300 characters.
• The dedupe key you map in the step is kept only as a hash, since it can come from any property.
• Logs never hold network requests or responses, HubSpot record properties or tokens.
• The capture script sends nothing to Ledion. Click IDs go from the visitor’s browser to HubSpot with your form.

What Ledion stores

• Your setup: settings, plan, conversions and where each one goes.
• Network connections: the tokens and account IDs Ledion needs to send, encrypted.
• Activity: one row per send, with each network’s result, the error code and message, and which kinds of detail were present.
• What was sent: for “Once per record”, which HubSpot record IDs already sent each conversion to each network. Record IDs are HubSpot’s numbers, not names or emails.
• Tracking health: daily counts, never single contacts.
• Your team’s email addresses for alerts: the person who installed Ledion, plus any alert emails you add. These are the only personal data Ledion keeps for your account.

Encryption

• HubSpot and ad network tokens are encrypted before they’re stored, with AES-256-GCM and a fresh random value for each encryption. Each one is tied to its own row, so it can’t be copied to another.
• The keys are secrets in Ledion’s hosting, Cloudflare. They’re never in code, and they can be rotated: Ledion re-encrypts every token with the new key, then retires the old one.
• Ledion runs on Cloudflare: Workers for the code, D1 for the database, Queues for sends.

Every request is checked

• From HubSpot: every request from the workflow step, the conversion list and Ledion’s pages inside HubSpot carries HubSpot’s signature. Ledion checks it and rejects anything that doesn’t match, or whose timestamp, when HubSpot sends one, is more than 5 minutes old.
• Your account only: on Ledion’s pages, the HubSpot account and user come only from that signed request, and every read and write is limited to that account.
• Network sign-ins (Microsoft, and Google when its sign-in is live) use a one-time state that expires after 10 minutes, plus PKCE where the provider supports it.
• Payments: Ledion checks Stripe’s signature on every billing update and handles each one once.
• The beta form on ledion.io is protected by Cloudflare Turnstile and a rate limit.

Only the access it needs

Ledion asks HubSpot for these scopes, and only these:

Scope	Why
oauth	Required for every app installed in HubSpot
automation	The Send conversion step, and telling HubSpot when it’s done
crm.objects.contacts.read	Read a contact’s details at send time, and count click IDs for Tracking health
crm.objects.deals.read	Read a deal’s amount and currency, and its contacts
crm.schemas.contacts.write	Create the Ledion property group and its click ID properties when you install

Ledion can read contacts and deals but can’t edit or delete them. With each ad network, it asks only for what it needs to upload conversions and list where they can go.

How long Ledion keeps data

Data	Kept for
Activity (sends and each network’s result)	90 days
What was sent, for “Once per record”	400 days
Tracking health counts	400 days
A network sign-in in progress	10 minutes, then deleted within the hour
Everything for your HubSpot account	Until 30 days after you uninstall, or until a deletion request is done
Beta signups from ledion.io	Until the person asks to be removed, or 24 months

Deleting your data

• Uninstall: Ledion stops processing and deletes its HubSpot tokens as soon as it learns of it (at once from Ledion’s Settings, within a day from HubSpot’s Connected apps), then deletes everything else for your account 30 days later. Reinstall within 30 days to keep your setup. Disconnect and uninstall has the steps.
• Remove a connection: its credentials are deleted at once.
• Ask for deletion: in Ledion’s Settings, choose Request data deletion, or email santi@ledion.io. I confirm by email first, then delete everything Ledion stores for your account within 30 days.

Report a security issue

Email santi@ledion.io with what you found and how to reproduce it.