Security
How LASSO signs people in, keeps companies apart, handles email, location, files and AI, where it runs, and what we have not built yet.
Sample screen. Names and numbers are made up.
| Rate limit | Limit |
|---|---|
| Failed sign-ins | 8 per email, or 40 per network address, in 15 minutes |
| Password resets | 3 an hour per person |
| Incoming leads | 60 a minute per key |
| Personal API keys | 600 calls a minute per key |
Your company
Each company has its own LASSO address, like yourcompany.lassoreps.com. A login works only at its own company's address. Someone from another company who tries to sign in at yours gets the same "email or password is not right" message as a wrong password.
Every record carries your company's tag, and every request LASSO answers filters on it. That is how one company's people never see another company's records.
WebPro360 builds and runs LASSO. Our staff can sign in to any company's LASSO and see its data, to set it up, support it and run the service.
When a rep connects Outlook or Google (both Rolling out), LASSO looks at mail to and from your known contacts and leads and logs who, the subject and when, on the right record. It never reads or stores a message body. Mail between coworkers is skipped.
Microsoft's permission LASSO asks for does not include message bodies. Google's Gmail permission technically allows reading mail, so LASSO asks Gmail only for the From, To, Cc, Subject and Date lines.
Email a rep sends from LASSO goes out through their own mailbox. LASSO keeps the subject and a line like "Emailed Dana", not the body.
Sample data. This is all LASSO keeps from an email.
Location
The rules are built into LASSO, and a manager cannot switch sharing on for a rep.
Off until the rep turns it on. The rep picks the hours, and a banner shows the whole time it is on. Nothing is recorded while it is off or outside those hours. Managers see positions only for reps who share. Points are deleted after 90 days.
AI
Anything AI would add or change in your records is shown to the rep as a draft. Nothing is saved until the rep confirms.
| What | Where it is processed | Before it is saved |
|---|---|---|
| Business card photos | Anthropic's API (Claude) | The rep checks every field, then saves |
| Voice recordings | Transcribed on Cloudflare Workers AI. The audio does not go to Anthropic. | The recording is kept with the note |
| Voice note and Recap my day text | The transcript (text only) goes to Anthropic's API | Every proposed action is a checked row the rep confirms |
| Meeting prep | The account's history, deals, activity and contacts' names and titles go to Anthropic's API | Shown to the rep to read, changes nothing |
| Door lines for found businesses | Public facts about the business go to Anthropic's API | Shown to the rep to read |
| Email template writing and tailoring | The draft and the account's facts go to Anthropic's API | The rep edits and sends |
| Daily brief, scoring, next best action | No AI. These are rules. | Not applicable |
LASSO runs on Cloudflare: the app, the database, file storage, voice transcription and LASSO's own system email.
Business card photos, voice recordings and pin photos are stored in Cloudflare's file storage under your company's folder, and served only to signed-in people at your company. They are not deleted on a timer.
| Who else handles data | What |
|---|---|
| Cloudflare | Hosting, database, files, voice transcription, system email |
| Anthropic | Card photos and the text tasks in the AI table |
| DataForSEO | Google listings and reviews for lead searches: the search area, building categories, and names and websites of the businesses found. Not your customer list. |
| Microsoft or Google | Only when a rep connects Outlook or Google: mail sent, mail headers, busy times, meetings |
| Salesforce | Only with the Salesforce add-on: the records you sync |
| US Census and OpenStreetMap address services | Addresses to place on the map, and areas typed into a search |
| Your webhook addresses | Whatever events your managers send there |
| Map, font and script providers | Loaded by the browser, so they see the visitor's network address |
Not yet
We would rather you hear it here than in a security review.
| Item | Today |
|---|---|
| Two-factor sign-in | Not offered yet. On the roadmap. |
| Single sign-on (Google or Microsoft) | Not offered yet. On the roadmap. |
| Audit log | Not offered yet. On the roadmap. |
| SOC 2 report | We do not have one. |
| Company-wide export in one click | Not offered yet. Each rep can export their own records as CSV and .xlsx today. |
| Roles beyond rep and manager | Not offered yet. On the roadmap. |
The full terms are in our privacy policy and terms of service.
Questions
No. All companies run on the same LASSO service. Every record is tagged with its company and every request filters on that tag, so one company never sees another's records.
Yes. WebPro360 builds and runs LASSO, and our staff can see a company's data to set it up, support it and run the service.
Only the headers of mail to and from your known contacts and leads: who, the subject and when. Never the body. This applies once Outlook or Google is connected, which is rolling out.
LASSO sends card photos and text to Anthropic's API to do the job in front of the rep, and voice audio is transcribed on Cloudflare. Read Anthropic's own terms for how its API handles data; LASSO does not train any model on your records.
Not yet. Both are on the roadmap. Today sign-in uses hashed passwords, one-time links and rate limits.
Each rep can export their own records as CSV and .xlsx. A one-click company-wide export is not built yet; talk to us about what you need.
Request a demo
Tell us where you sell and what you sell, and the walk-through uses buildings near you instead of a canned list. A person replies. No card, no contract to see it.