Trust Center

    How we earn your trust.

    Every claim on this page is independently verifiable. Click any external link to verify on a public scanner. We re-check every row monthly and post a quarterly trust report.

    The full picture

    Privacy Policy

    What we collect, why, and your rights.

    AI Principles

    Our stance on AI training, citation, and disclosure.

    Accessibility (WCAG 2.2 AA)

    Conformance status and our published VPAT 2.5 report.

    VPAT 2.5

    Procurement-grade Accessibility Conformance Report (HTML mirror + PDF).

    Uptime status

    Real-time uptime and incident history.

    Vulnerability Disclosure

    How to report a security vulnerability — scope, safe-harbor, response SLA.

    DMCA Policy

    Notice-and-takedown procedure and counter-notice process.

    AI Content Declaration

    Site-wide policy: pages are human-authored unless explicitly tagged otherwise.

    Terms of Service

    Pricing, ownership, timelines — in plain English.

    Verify our identity yourself

    We do not ask you to take our word for it. Every grade below comes from a public scanner and is re-run monthly. The consolidated baseline lives in docs/geo/trust-baseline.md.

    • TLS / SSL Labs grade

      A (target A+)

      Verify

    • Mozilla Observatory

      A (target A+)

      Verify

    • securityheaders.com

      A (target A+)

      Verify

    • DMARC posture

      p=quarantine; pct=100; aligned

      Verify

    • Google Safe Browsing

      Safe

      Verify

    • security.txt (RFC 9116)

      Published & valid

      Verify

    Verified trust marks

    Authentic only. Each mark links to its public verifier. We do not display fabricated, expired, or self-issued seals — see docs/geo/trust-marks.md.

    • TLS / SSL Certificate

      All traffic to leadstosalesagency.com is served over TLS 1.3 with a Let's Encrypt certificate (auto-renewed every 90 days). HSTS is preloaded.

      Verify on SSL Labs

    • Security Headers

      Strict CSP, HSTS preload, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a locked-down Permissions-Policy ship on every response. Re-graded monthly.

      Verify on securityheaders.com

    • Mozilla Observatory

      We track CSP, cookies, CORS, HSTS, redirection, referrer policy, SRI, X-Content-Type-Options, X-Frame-Options, and X-XSS-Protection on Mozilla Observatory.

      Verify on Mozilla Observatory

    • Email Authentication (SPF · DKIM · DMARC)

      All outbound mail from our domain is SPF + DKIM aligned with a DMARC quarantine policy and aggregate report routing.

      Verify on MX Toolbox

    • Google Workspace Customer

      Email is delivered via Google Workspace, governed by Google's Workspace agreement (no advertising or model-training use of customer data).

      View Google Workspace Terms

    Aspirational (not displayed elsewhere on the site)

    We do not display the following marks anywhere on the site until they are independently verifiable in the listed directory.

    • Google Partner — Application pending. Will only be displayed once it is independently verifiable in the Google Partners directory.
    • GoHighLevel Partner — Application pending. Will only be displayed once it is independently verifiable in the GoHighLevel partner directory.

    Security contact

    Reporting a security issue, a vulnerability, or a brand impersonation? Use one of the channels below — we acknowledge within 1 business day.