Your leads are yours. Here’s how we keep it that way.
Cordello holds the most valuable list a company makes all year. This page says plainly what we do with it, what we can see, and what we can’t.
Where data lives
Customer data is stored in Microsoft Azure (US Central) in an encrypted PostgreSQL database with encryption at rest, automated backups, and TLS on every connection. Uploaded images (rep photos, company logos) live in the same region.
What our staff can see
Cordello’s internal operations console shows counts and timestamps per workspace — how many leads, when the last capture happened. It cannot open a customer’s lead book. Access is restricted to named Cordello staff by allowlist and every action they take is logged.
Access to your workspace
Every member signs in with their own account; owners and managers control roles and can deactivate a member in one click. Sign in with Microsoft or Google is available for workspaces that use them. Sessions are signed, HTTP-only cookies. The workspace audit trail records sign-ins, captures, imports, exports, team changes, billing events, and erasures.
Connected accounts
When a rep connects a mailbox or an owner connects a CRM, Cordello stores only a refresh token, encrypted with AES-256-GCM under a key held outside the database. Access tokens exist only for the length of one request. Disconnecting revokes our use immediately; we never read inbox contents.
Public pages
Buyer pages, digital cards, show reports and meeting pages are reachable by an unguessable signed link, never by a sequential id, and carry no app session. Reach analytics count real actions (a card viewed, a booking clicked); Cordello never embeds open-tracking pixels in email.
Consent
When a person shares their own details — at the booth kiosk, from a rep’s card, or when booking a meeting — the page states that the exhibitor may contact them, and the lead records how consent was given. Leads captured by a rep are the exhibitor’s own business-contact data.
Portability & erasure
Owners can export the whole workspace as one JSON file at any time, and the lead book as CSV. Any lead can be erased from its page, taking its page, meetings and timeline with it; the activity log keeps only the name. Closing a workspace removes its data.
Subprocessors
Microsoft Azure (hosting, database, storage, and the OpenAI models that read cards and draft follow-ups — run in Azure, not sent to OpenAI); Microsoft Graph and Google Workspace (only when a rep connects a mailbox); HubSpot or Salesforce (only when an owner connects one); Stripe (billing — Cordello never sees card numbers).
Vulnerability reports
Found something? Write to security@cordello.app. We acknowledge within two business days and keep you informed until it’s fixed.
On the roadmap
SOC 2 Type I, SAML single sign-on for larger programs, and customer-managed data retention windows. We’ll say here when each one ships — not before.