Data Flows

What Quicklead receives, stores and sends on

Written for the person doing your vendor review. Every field we take in, where it is held, which components touch it and exactly what crosses the boundary into your systems.

Hosting: DigitalOcean, United States Entity: India TLS 1.2+ and AES-256

Last reviewed September 2026

Inbound

What Quicklead receives

Source	Data	How it arrives
Your team	Account details, billing contact, workspace and seat configuration	Entered in the app
Your LinkedIn account	Your own profile, connections, sent invitations and inbox	Your authenticated session, operated on your instruction
Prospect LinkedIn profiles	Name, headline, current company and role, location, industry, summary, education, skills, languages, profile URL and picture	Read from profiles your campaign targets
Email Finder	Work email, and in some records a business phone number and company domain	Looked up in Quicklead’s own contact database by profile URL
Your prospects	Replies, acceptance events and message history	Received into the Smart Inbox
Your CSV or Sales Navigator import	Whatever columns you upload	File upload
Your CRM, if connected	Contact records, where you enable contact import	OAuth connection

Fields worth flagging to your reviewer Some Email Finder and imported records can carry a personal rather than a business phone or email, and profile records can include date of birth where an individual has published it on LinkedIn. We hold those fields because the source exposes them, we do not require them, and they are removable on request.

At rest

Where it is stored

Store	What lives there	Location
Managed MySQL	Accounts, teams, workspaces, plans, integration configuration, credit history	DigitalOcean, United States
MongoDB	Per-workspace prospect records, campaigns, connections, inbox, notes, pipelines, the Email Finder dataset	DigitalOcean, United States
Object storage	Uploaded files, exports and attachments	DigitalOcean, United States
Message queue	In-flight campaign and sync jobs, transient	Quicklead-operated
Backups	Encrypted database snapshots	Same region as the source

Each customer workspace has its own prospect, campaign and connection collections. Workspaces are isolated from one another, and agency accounts can isolate each client further.

HubSpot

Exactly what moves between Quicklead and HubSpot

The most common question in a security review, so here is the precise answer rather than a general one.

Permissions Quicklead requests

Two OAuth scopes, and no others:

crm.objects.contacts.read

crm.objects.contacts.write

Quicklead therefore cannot access deals, tickets, companies, quotes, marketing email, workflows, forms, files, reporting, settings or your HubSpot users. If the consent screen shows anything beyond those two scopes, do not approve it and tell us.

Direction of travel

Quicklead → HubSpot. Event-driven. Nothing is sent unless you subscribe the integration to that event type, and you choose which of the four events are enabled.

HubSpot → Quicklead. Contact records only, and only if you switch on contact import. With it off, the connection is write-only.

Tokens are stored encrypted, refreshed automatically, and revoking the app in HubSpot stops the flow immediately.

Field sent to HubSpot	What it is	When
Campaign name	Which Quicklead campaign the event came from	Every subscribed event
Event type	Accepted invitation, positive reply or negative reply	Every subscribed event
First and last name	The prospect’s name as shown on LinkedIn	Every subscribed event
LinkedIn profile URL	The prospect’s public profile link	Every subscribed event
Message sent	The outreach message your user sent	Reply and acceptance events
Reply received	The full text of the prospect’s reply	Reply events
Sentiment flag	Whether Quicklead classified the reply as positive or negative	Reply events
Sending account identifier	The public identifier of your user’s own LinkedIn profile	Every subscribed event

The one to brief your Head of Risk on Reply text is included in the payload. Whatever a prospect writes back is written into your HubSpot contact record. That is normally desirable, but it means prospect-authored free text crosses into your CRM, so it belongs in your own ROPA.

Other destinations

Everywhere else data can leave

All of these are off by default. Each one is enabled by you, per workspace.

Destination	What it receives	Enabled by
Zoho CRM	The same event payload as HubSpot	OAuth connection you authorise
Zapier	The full event payload to your catch hook	A Zapier hook URL you provide
Slack	Event notifications to a channel you choose	A Slack webhook you provide
Custom webhook	The event payload to any endpoint, with your own headers or bearer token	A URL you configure
Google Sheets	Exported contact rows	Google OAuth you authorise
CSV / Excel export	Whatever you choose to export	You, in the app

FAQ

Data flow questions

Contacts, and nothing else. The OAuth connection requests two scopes, crm.objects.contacts.read and crm.objects.contacts.write. That grants no access to deals, tickets, companies, marketing email, workflows, files, reporting or your HubSpot users.

Yes, to the systems you connect it to. If you enable the HubSpot, Zoho, Zapier, Slack or webhook integration for reply events, the reply text is included in the payload so it lands in your CRM. That is usually the point, but it should be a deliberate choice, so we state it here rather than in a footnote.

Yes. AI Messages, AI ICP Scoring and the classification features are optional. With them disabled, no prospect data is sent to OpenAI or OpenRouter at all.

Export everything at any time from the app. On account closure, workspace data is deleted within 30 days, backups age out on their own cycle, and invoices are retained where tax law requires it.

Trust Center GDPR Center Data Flows Sub-processors DPA Contacted through Quicklead? Security Privacy Policy

Need the architecture diagram?

We will send the full data-flow document, the network diagram and our completed CAIQ, usually within two business days.

Start free trial Book a 15-min demo

No credit card required · Full product trial · Cancel any time