Security

Gmap Data is built on account isolation, server-side sessions and least-privilege access to third-party credentials, with an append-only audit trail for financial state.

Account isolation

Business data — runs, saved businesses, contacts, projects, exports and integrations — is owned by your account. Every product request is scoped server-side from your authenticated session; request parameters can never select another account.

Authentication and sessions

Passwords are stored as salted PBKDF2-SHA256 hashes. Customer sessions are opaque server-side tokens (only a hash is stored), sent in HttpOnly cookies with SameSite protection, and can be revoked from your account page or on password reset. State-changing requests require a CSRF token. Durable rate limits protect sign-in, sign-up and password-reset.

Provider credentials

Enrichment and verification providers are bring-your-own-key. Keys you connect are encrypted at rest with AES-256-GCM using a key held outside the application database, are never returned to the browser, and are only decrypted to make the calls you request. Platform-level credentials are mounted read-only and never exposed to the frontend.

Financial integrity

Credits are tracked in an append-only ledger with idempotent operations and reconciliation. Payment webhooks are signature-verified and processed through a durable, replay-safe state machine.

Reporting a concern

If you believe you have found a security issue, please contact us before disclosing it publicly so we can assess and respond.