Security and Data Handling
How we protect our website, your information and the accounts you trust us with.
At a glance
- HTTPS and security headers
- Form spam protection and throttled logins
- Manager access, never your passwords
- We collect only the data we need
- We notify you of incidents that affect you
- Report a vulnerability by email
Effective date: October 23, 2026. Last updated: October 23, 2026.
Website and forms
- HTTPS on every page once live, with security headers.
- Form spam protection (honeypot, rate limits and optional Cloudflare Turnstile).
- Admin area protected with hashed passwords, login throttling and CSRF tokens.
- Lead data stored in a private database that is not reachable from the web.
Client accounts
- We use manager or partner access (for example Google Ads manager accounts and Meta Business Manager) instead of sharing your passwords.
- We ask for the lowest access level that lets us do the work, and remove it when we stop working together.
- We recommend two-factor authentication on every account you own.
Data minimisation
We collect only what we need, keep it only as long as needed, and avoid sending sensitive data (for example health details) to advertising platforms.
Service providers
Hosting, email, analytics, call tracking, CRM, spam protection and payment providers process data for us under their own security programs. A current list is available on request.
Incidents
If we learn of a security incident that affects your information, we will notify you without undue delay and as required by law.
Data processing agreement
Clients can request a data processing agreement (DPA) by email.
Report a vulnerability
Found a security issue on our site? Email connect@repvox.com with the subject "Security report". Please do not access data that is not yours or disrupt the service.