Your borrowers trust you. You can trust us with their data.
mfileads stores personal data about the people you serve. We treat that as the most important thing we do — here is exactly how.
Encryption in transit
Every page and API call is served over HTTPS with HSTS. Plain HTTP is redirected.
Isolated per institution
Every lead, message and task belongs to one institution, and every query is scoped to the signed-in user’s institution.
Role-based access
Owners, admins and agents see only what their role allows. Agents work their own leads.
Session & sign-in protection
Two-factor authentication that a workspace owner can require for everyone, hashed passwords, rate-limited sign-in, device lists with remote sign-out, and automatic sign-out after inactivity.
Audit log
Sign-ins, exports, deletions, imports and settings changes are recorded with user, time and IP address.
Secure engineering
Prepared SQL statements, output escaping, CSRF tokens on every form, a strict Content Security Policy, and spreadsheet-injection-safe exports.
Consent enforcement
Outreach is blocked for leads without recorded consent or who have opted out. Opt-outs take effect instantly.
Data-subject rights
Export a single person’s record, or erase it permanently with its history, in one click.
Roles under data-protection law
Your institution is the data controller for the leads you collect: you decide why and how they are used. mfileads is your data processor: we store and process that data only on your instructions, under our data processing agreement.
The product is designed around the requirements common to Kenya’s Data Protection Act 2019, Uganda’s Data Protection and Privacy Act, Nigeria’s NDPA 2023, Ghana’s Data Protection Act, South Africa’s POPIA and the EU GDPR: a lawful basis for processing, consent for direct marketing, a simple opt-out, and the rights of access and erasure.
What we do not do
- We do not sell, rent or share your leads with anyone, and we do not pool data across institutions.
- We do not buy or scrape personal data to “discover” prospects for you.
- We do not use gender, age, religion, ethnicity or tribe in lead scoring.
Responsible disclosure
Found a vulnerability? E-mail security@mfileads.com. Please give us reasonable time to fix it before disclosure; we will not take action against good-faith research.
We describe only controls that are in place today. mfileads does not currently hold ISO 27001 or SOC 2 certification.
Questions from your risk or compliance team?
Book a call and we will walk them through how mfileads handles consent, access control and data-subject requests.
- 14 days free
- No credit card
- Import your list in minutes
- Cancel any time