Security Whitepaper

Version 1.0 | December 2025

This document provides a comprehensive overview of Ledly’s security architecture, practices, and compliance considerations for higher education institutions evaluating our lead management platform.

Executive Summary

Ledly is a lead management platform purpose-built for higher education institutions. We understand that colleges and universities handle sensitive prospective student information that requires the highest levels of protection. This whitepaper details our comprehensive approach to security, covering infrastructure, data protection, access controls, and compliance considerations.

Key Security Highlights

Security Architecture

Infrastructure Overview

Ledly operates on a modern, cloud-native infrastructure designed for reliability, scalability, and security.

Hosting Platform

Ledly is hosted on Railway, a Platform-as-a-Service (PaaS) provider that offers:

• Automated deployments with zero-downtime updates
• Horizontal scaling to handle traffic spikes during enrollment periods
• Geographic redundancy for high availability
• Managed infrastructure with security patches applied automatically
• Private networking between application services
• DDoS protection at the infrastructure level

Database Infrastructure

Network Security

Transport Layer Security

All data transmitted to and from Ledly is encrypted using industry-standard protocols:

• TLS 1.3 for all HTTPS connections (TLS 1.2 supported for legacy clients)
• HSTS (HTTP Strict Transport Security) enforced with 1-year max-age
• Forward secrecy using ephemeral key exchanges
• Strong cipher suites with weak ciphers disabled

Supported Cipher Suites:
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- TLS_AES_128_GCM_SHA256

API Security Layers

Request Flow:
Client → TLS Termination → WAF → Rate Limiter → Authentication → Authorization → Application

Data Encryption

Encryption at Rest

All data stored by Ledly is encrypted at rest:

Encryption in Transit

Authentication and Authorization

JWT-Based Authentication

Ledly uses JSON Web Tokens (JWT) for user authentication, providing secure, stateless session management.

Token Architecture

JWT Structure:
{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "user_id",
    "org": "organization_id",
    "role": "user_role",
    "iat": 1703577600,
    "exp": 1703664000
  },
  "signature": "HMAC-SHA256(header.payload, secret)"
}

Token Security Measures

Role-Based Access Control (RBAC)

Ledly implements granular role-based access control to ensure users only access data and functions appropriate to their responsibilities.

Available Roles

Permission Matrix

OAuth 2.0 for CRM Integrations

Ledly uses OAuth 2.0 to securely connect with CRM systems like HubSpot and Microsoft Dynamics.

Integration Security Model

CRM Integration Security

Data Protection

Personally Identifiable Information (PII) Handling

Ledly processes prospective student information that may include PII. We implement strict controls around this data:

PII Data Categories

PII Protection Measures

Data Retention Policies

Ledly provides configurable data retention to meet institutional policies and regulatory requirements.

Default Retention Periods

Data Deletion

Multi-Tenant Data Isolation

Ledly is a multi-tenant platform serving multiple higher education institutions. We implement strict data isolation:

Isolation Architecture

Organization A          Organization B
     |                       |
     v                       v
[API Gateway with Org Validation]
     |                       |
     v                       v
[Org A Data Partition]  [Org B Data Partition]
     |                       |
     v                       v
[Org A Encryption Key]  [Org B Encryption Key]

Isolation Guarantees

API Security

Rate Limiting

Ledly implements rate limiting to prevent abuse and ensure fair resource allocation.

Rate Limit Tiers

Rate Limit Headers

HTTP/1.1 200 OK
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1703577660

When rate limited:

HTTP/1.1 429 Too Many Requests
Retry-After: 60
 
{
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Too many requests. Please retry after 60 seconds.",
    "retry_after": 60
  }
}

Input Validation

All API inputs are validated before processing to prevent injection attacks and data corruption.

Validation Layers

Validated Fields

CORS Policies

Cross-Origin Resource Sharing (CORS) is configured to allow only authorized origins.

CORS Configuration:
{
  "origin": ["https://app.ledly.io", "https://*.ledly.io"],
  "methods": ["GET", "POST", "PUT", "DELETE", "PATCH"],
  "allowedHeaders": ["Authorization", "Content-Type", "Authorization"],
  "credentials": true,
  "maxAge": 86400
}

Webhook Signature Verification

All outgoing webhooks are signed using HMAC-SHA256 to ensure authenticity and integrity.

Signature Generation

Signature = HMAC-SHA256(timestamp + "." + payload, webhook_secret)

Verification Headers

Replay Attack Prevention

• Timestamp must be within 5 minutes of current time
• Each delivery ID is unique and can be used for idempotency
• Signature includes timestamp to prevent reuse

Compliance Considerations

FERPA Awareness

The Family Educational Rights and Privacy Act (FERPA) governs the handling of student education records. While Ledly processes prospective student inquiries (typically before enrollment), we design our platform with FERPA principles in mind.

FERPA-Aligned Practices

Education Records Considerations

GDPR Considerations

For institutions with prospective students from the European Union, Ledly supports GDPR compliance requirements.

Lawful Basis Support

Data Subject Rights

Ledly provides tools to support data subject rights:

Data Transfer Mechanisms

Additional Frameworks

Incident Response

Monitoring and Logging

Ledly maintains comprehensive monitoring and logging to detect and respond to security incidents.

Monitoring Coverage

Log Retention

Breach Notification Procedures

Ledly maintains a documented incident response plan with defined notification procedures.

Incident Classification

Notification Timeline

Vendor Security

Third-Party Integrations

Ledly integrates with various third-party services to provide CRM synchronization and webhook delivery.

Integration Security Requirements

Integration Data Flow

Ledly → Encrypted Connection (TLS 1.2+) → CRM/Webhook Endpoint
        ↓
   OAuth Token or
   HMAC Signature
        ↓
   Lead Data (PII)

Subprocessor Management

Ledly maintains a list of subprocessors that may handle customer data.

Current Subprocessors

Subprocessor Changes

• 30-day advance notice for new subprocessors
• Customer objection process available
• Updated list published at docs.ledly.io/security/subprocessors

Security Practices

Secure Development Lifecycle

Ledly follows secure development practices throughout the software development lifecycle.

Development Security

Dependency Management

Third-party dependencies are monitored for vulnerabilities:

Vulnerability Response

Code Review Practices

All code changes require review before deployment:

Security Contact

For security-related inquiries, vulnerability reports, or to request additional documentation:

Vulnerability Disclosure

If you discover a security vulnerability in Ledly:

1. Email [email protected] with details
2. Include steps to reproduce if possible
3. Allow reasonable time for remediation before public disclosure
4. We commit to acknowledging reports within 48 hours

Document History

Request Additional Information

For enterprise customers, additional documentation is available upon request:

• Penetration test reports (under NDA)
• SOC 2 readiness assessment
• Custom security questionnaire completion
• Technical architecture diagrams
• Data flow documentation

Contact [email protected] to request access.