Security
A lead carries a real person, their phone number, their address, and the record of what they agreed to. Here is what protects it, stated without a badge we have not earned.
Controls at a glance
Six things that are true of every program, not of a premium tier.
Encrypted in transit
Every path carries TLS: the forms that capture leads, the posts we make to your endpoint, the webhook events, and the REST API. Plain HTTP delivery is not an option we offer, including for testing.
Encrypted at rest
Lead records, consent records, and delivery logs are stored encrypted. Backups carry the same protection as the primary store, because a backup of regulated contact data is still regulated contact data.
Scoped credentials
A signing secret for verifying deliveries, an API token for the buyer-facing endpoints, and the credential your own endpoint expects, all issued separately and revocable on their own so a rotation is not an outage.
Least-privilege access
Internal access to lead and consent data is limited to the people whose work requires it, granted by role rather than by request, reviewed periodically, and removed when someone changes roles.
Minimum necessary data
Forms collect what an agent actually needs to serve the prospect and nothing else. We do not collect Social Security numbers, financial account details, or medical records at acquisition.
Retention with an end date
Lead and consent records are kept for a defined window that balances the evidence you may need against holding personal data nobody has a reason to keep, then deleted on schedule.
Encryption in transit and at rest
Both directions of the pipe, and the store in the middle. None of it is an option a program can be configured without.
- Capture is TLS. Every acquisition page and form runs over TLS, including the ones a prospect reaches from a paid placement on a phone.
- Delivery is TLS. We post to HTTPS endpoints only. An endpoint that offers plain HTTP is not configured, including during testing.
- Deliveries are signed. An HMAC over the timestamp and the raw body lets you verify a request came from us and has not been replayed. See verifying a signature.
- Storage is encrypted. Lead records, consent records, and delivery logs are encrypted at rest, and backups carry the same protection as the primary store.
- Secrets are not in the payload. Credentials travel in headers and in configuration, never in a lead body, so a record copied into a spreadsheet does not carry a key with it.
Access control and credentials
Two credential families guard two different doors, and internal access is a third question that most vendors never mention.
Credentials you hold
- A signing secret, used only to verify deliveries, rotatable without interrupting delivery.
- An API token for the buyer-facing endpoints, scoped to your account and restrictable to read-only.
- The credential your own endpoint expects, stored by us and presented on every post rather than embedded in a URL.
- Each is revocable on its own, so losing one does not mean rebuilding the integration.
Access inside Solved Marketing
- Granted by role rather than by request, and reviewed periodically rather than accumulated.
- Removed promptly when someone changes roles or leaves, which is the review that actually matters.
- Multi-factor authentication on the systems that hold lead and consent data.
- Access to consent records is logged, because the evidentiary value of a record depends on it being unaltered.
Consent and personal data, minimum necessary
The life of a lead, and what is true about the data at each step.
Captured at the form
A prospect submits a form on a page we run. The record captures the answers, the exact disclosure language shown, the timestamp, the IP address, the page URL, and the user agent. We know what every prospect was told because we wrote it, which is the direct consequence of owning the acquisition rather than buying it.
Filtered before it moves
Phone validation, duplicate suppression, licensing geography, age and product fit, and your own disqualifiers run before a record leaves. Internal suppression and opt-out state is applied at the same point, so a person who has asked not to be contacted is never delivered to anyone.
Delivered once, to one buyer
Each lead is delivered to a single buyer over TLS, signed so you can verify it came from us. It is not delivered to a second buyer, and it does not return to market later as an aged lead. That is a security property as much as a commercial one: fewer copies of a record means fewer places it can leak from.
Deleted on schedule
When the retention window closes, records are deleted rather than archived indefinitely. Deletion requests from a consumer are honored, with the caveat that suppression state has to survive deletion, because forgetting that someone opted out is the one way to get this wrong twice.
What we deliberately do not collect at acquisition: Social Security numbers, financial account details, and medical records. A field that is never collected cannot leak. The full list of what does arrive is on the delivery API reference, and the consent trail is described on the compliance page.
Retention, deletion, and subprocessors
Two questions nobody asks until something goes wrong: how long do you keep it, and who else touches it.
- Retention has an end. Lead and consent records are kept for a defined window, long enough to answer a consent request, a credit review, or a complaint, and not indefinitely.
- Deletion is deletion. When the window closes, records are deleted rather than moved into an archive that quietly keeps them forever.
- Suppression outlives deletion. An opt-out has to survive the deletion of the record it came from, or you will contact that person again. Suppression state is kept separately and deliberately.
- Subprocessors are reviewed. Infrastructure, validation, and communications providers are assessed before use and again periodically, limited to the data the function requires, and covered by contract terms on confidentiality and security.
- The list is available. Buyers can ask for the current subprocessor list rather than inferring it.
Your obligations, plainly
- Your copy
- Once a lead is delivered, your copy and how you protect it are yours.
- Your suppression
- An opt-out given to your agents has to be honored by you, and told to us.
- Your retention
- Keeping delivered leads forever is a decision, and it is worth making on purpose.
Compliance program
We would rather be believed about a smaller claim than doubted about a larger one, so this section says exactly where the program stands.
What is true today
The controls on this page are running: TLS on capture and delivery, signed deliveries, encryption at rest, scoped and revocable credentials, role-based internal access with periodic review, minimum-necessary collection, defined retention with scheduled deletion, and subprocessor review.
What is underway
Formal audit readiness work: control documentation, evidence collection, periodic access reviews, vendor and subprocessor review, policy management, and an incident response runbook that is exercised rather than filed. This is preparation, not a result.
What we will not claim
There is no completed SOC 2 report, no HIPAA attestation, no named auditor, no certificate number, and no badge on this page. When an audit completes, this section will say so plainly and the report will be available to buyers and prospects under NDA.
What you can get today: a completed security questionnaire, a written description of the control set, the retention specifics that apply to your program, the current subprocessor list, and a conversation with the people who operate it. Ask at contact@solvedmarket.ing.
Incident response and disclosure
Two commitments: you hear about an incident from us, and a researcher who finds something hears back from us.
- You hear it from us. Service incidents are posted to the status page and sent to your account contact, with an update at least every 60 minutes while one is open.
- Security incidents are different. If an incident affects data belonging to your program, you get a direct notification naming what was affected and what we did, not a line on a status page.
- Evidence, not narrative. After an incident you can have the delivery records and the timeline for the affected window rather than a summary of them.
- Planned work is announced. Maintenance gets at least 72 hours of notice and runs outside the hours your agents are on the phone.
- Security contact. contact@solvedmarket.ing, subject line starting Security, or +1 (866) 415-6192 if it is urgent.
Responsible disclosure
If you believe you have found a vulnerability in our acquisition pages, our delivery infrastructure, our API, or our sites, email contact@solvedmarket.ing with a subject line starting Security and enough detail to reproduce the issue. We acknowledge reports within one business day, keep you updated while we work, and will credit you when a fix ships if you want the credit.
In return we ask that you give us a reasonable window to fix the issue before disclosing it publicly, that you do not access, modify, or retain data belonging to anyone else, and that you do not degrade service for other buyers or for consumers while testing. Please do not submit fabricated leads at volume, run load tests, or contact real prospects as part of a test. We will not pursue legal action against researchers acting in good faith within those terms.
Security questions from a procurement process are welcome at the same address. Send the questionnaire and we will complete it, including the parts where the honest answer is not yet.
FAQs
Security questions
Are you SOC 2 certified?
No, and we will not imply otherwise. There is no completed SOC 2 report, no named auditor, and no certificate behind this page. Formal audit readiness work is underway: control documentation, evidence collection, access reviews, and subprocessor review. When an audit is complete we will say so here plainly and make the report available under NDA.
Are you HIPAA compliant?
We have not completed a HIPAA audit or attestation and do not claim one. What we can describe is the control set and the collection posture: acquisition forms collect coverage interest, budget bands, and self-reported flags rather than medical records, and the data is encrypted in transit and at rest with least-privilege access. If your use case involves protected health information, tell us during onboarding so we can talk through what we can and cannot support today.
What personal data is actually on a lead?
Name, phone, optional email, postal address, date of birth or age, the answers the prospect gave about coverage, and the consent record. No Social Security numbers, no financial account details, and no medical records. The full field list is on the delivery API reference so you can see exactly what arrives before you receive anything.
Who inside Solved Marketing can see lead data?
The people whose work requires it: the team operating the acquisition programs, the engineers who run delivery, and the account contact working your program. Access is granted by role rather than by request, reviewed periodically, and removed when someone changes roles or leaves.
What happens to a lead after I receive it?
We keep our copy for the defined retention window, because it is the record that answers a consent request, a credit review, or a complaint about a specific lead. Your copy is yours, and the obligations that come with it are yours as well. Suppression and opt-out requests that reach us are applied on our side and shared with you where a lead has already been delivered.
Do you use subcontractors or third-party services?
Yes, for infrastructure, phone validation, and communications. Subprocessors are reviewed before use and reviewed again periodically, limited to the data they need for the function they perform, and covered by contract terms on confidentiality and security. A current list is available to buyers on request.
How do I report a vulnerability?
Email contact@solvedmarket.ing with a subject line starting Security and enough detail to reproduce the issue. We acknowledge reports within one business day and will not pursue legal action against researchers acting in good faith under the disclosure terms on this page.
Something else? Contact us
Need the details in writing?
Send your questionnaire and we will complete it, including the parts where the honest answer is not yet.