Security

OpenLeadGraph is a private, multi-tenant platform for staffing agencies. Every client works in an isolated workspace hosted on DK Engineering Lab server infrastructure, with Cloudflare in front of it as the edge protection layer. Security is built into the architecture rather than added on top of it.

All application servers, databases and backups run on infrastructure operated by DK Engineering Lab (https://www.dkenglab.com). The platform is not scattered across third-party services: application, data and backups stay inside one controlled perimeter with individually attributable administrative access.

• Hardened, regularly patched server images with a minimal exposed surface.
• Least-privilege access for engineering staff, bound by confidentiality agreements.
• No direct public access to databases — application layer only.

All traffic to the platform passes through Cloudflare before it reaches our servers:

• DDoS mitigation at the network edge — volumetric attacks are absorbed by Cloudflare's global network before reaching the origin.
• Web Application Firewall (WAF) filtering malicious requests, injection attempts and known exploit patterns.
• TLS termination with modern cipher suites; connections between Cloudflare and the origin are encrypted as well.
• Bot management and rate limiting that protect authentication endpoints from credential stuffing and brute force.
• DNS protection and high-availability routing through Cloudflare's anycast network.

Each client receives a logically isolated workspace. Isolation is enforced at the application and data layers: every query, cache entry, file path and background job is scoped to the owning tenant. Cross-tenant access is architecturally impossible, and access roles are configured per workspace — owners, recruiters, sales and read-only users see exactly what their role allows.

• In transit: TLS for every connection — browser to Cloudflare, Cloudflare to origin, and internal service communication.
• At rest: stored data and backups are encrypted on DK Engineering Lab infrastructure.
• Credentials: passwords are hashed with modern one-way algorithms; session tokens are short-lived and revocable.

• Daily encrypted backups of all workspace data.
• Documented restore procedures, tested periodically.
• After a client's subscription ends, workspace data is deleted after a 30-day export window; backup copies expire within the normal rotation cycle.

• 24/7 infrastructure monitoring and alerting on DK Engineering Lab servers, complemented by Cloudflare analytics at the edge.
• Access and audit logging of administrative actions inside workspaces.
• A defined incident-response process: containment, analysis, notification of affected clients without undue delay (aligned with the 72-hour GDPR window), and post-incident review.

• Role-based access control inside each workspace; sensitive actions require elevated roles.
• Security headers on all responses (HSTS, content-type protection, frame protection, referrer policy).
• Input validation and output sanitization across API routes; structured, redacted server logging without sensitive payloads.
• Updates are tested before production rollout; security patches are applied on a prioritized schedule.

AI features (fit scoring, CV tailoring, in-product assistant) process only the fields required for the task, within the client's own workspace. Client data is not used to train models for the benefit of other clients, and prompts are limited to the minimum necessary fields.

We target 99.9% monthly availability for the production platform. Cloudflare's anycast network provides resilient global routing at the edge; origin availability, backups and failover procedures are managed on DK Engineering Lab infrastructure. Planned maintenance is announced in advance.

If you believe you have found a vulnerability, please report it privately to hello@openleadgraph.com — we investigate all reports and respond within one business day. Please do not test against other clients' data or disrupt the service.