generated: '2026-08-13' method: searched source: https://support.leadspace.com/hc/en-us/articles/360012276859-General-Statement-of-Information-Security-and-Privacy update_note: >- UPGRADE 2026-08-13. The launch of the Leadspace MCP server added a genuine standards surface that did not exist in the 2026-07-19 pass: Model Context Protocol, OAuth 2.1 authorization-code + PKCE, RFC 9728 protected-resource metadata, RFC 8414 authorization-server metadata and RFC 7591 dynamic client registration — all verified by live probe. Entries below are scoped to the surface they apply to, because the v4 REST gateway and the MCP server conform to different things. standards: - id: model-context-protocol conforms: true applies_to: https://skprod.leadspace.com/mcp/v1 evidence: >- Published remote MCP server; documented as a custom connector for Claude (web/desktop/Code) and ChatGPT (Developer Mode connectors, Codex) and "any MCP-compatible client". POST tools/list returns a spec-shaped 401 with an RFC 9728 Bearer challenge rather than a generic error. docs: https://www.leadspace.com/solutions/leadspace-mcp - id: rfc9728-oauth-protected-resource-metadata conforms: true applies_to: https://skprod.leadspace.com/mcp/v1 evidence: >- /.well-known/oauth-protected-resource returns 200 application/json naming resource https://skprod.leadspace.com/mcp/v1, its authorization server, supported scopes and bearer methods; the WWW-Authenticate challenge cites the same metadata URL. - id: rfc8414-oauth-authorization-server-metadata conforms: true applies_to: https://skprod.leadspace.com/mcp/v1 evidence: /.well-known/oauth-authorization-server returns 200 with issuer, authorization, token, registration and jwks endpoints. - id: rfc7591-dynamic-client-registration conforms: true applies_to: https://skprod.leadspace.com/mcp/v1 evidence: >- registration_endpoint https://stg-sk.us.auth0.com/oidc/register is advertised, and the provider's own setup instructions tell the user to leave the OAuth client fields blank. - id: oauth2-pkce-rfc7636 conforms: true applies_to: https://skprod.leadspace.com/mcp/v1 evidence: code_challenge_methods_supported ["S256"]. - id: oauth21-authorization-code conforms: true applies_to: https://skprod.leadspace.com/mcp/v1 evidence: authorization_code + refresh_token grants, PKCE S256, public client (token_endpoint_auth_method "none") — the OAuth 2.1 MCP profile. - id: oidc conforms: partial applies_to: https://skprod.leadspace.com/mcp/v1 evidence: >- The MCP authorization server is an Auth0 OIDC tenant advertising openid / profile / email scopes and a full openid-configuration. Leadspace itself publishes no OIDC discovery document on its own hosts, so this conformance belongs to the delegated identity provider, not to a Leadspace endpoint. - id: a2a-agent-card conforms: false evidence: >- /.well-known/agent-card.json and /.well-known/agent.json 404 on www.leadspace.com and apigw.leadspace.com, and return the SPA HTML catch-all (soft 404) on studio.leadspace.com and skprod.leadspace.com. - id: oauth2 conforms: true evidence: >- Leadspace publishes an OAuth 2.0 username-password (resource owner password credentials) flow at POST/PUT https://apigw.leadspace.com/oauth/authorize with token + refreshToken + expiration, documented in the API v4 OAuth 2.0 Diagram. docs: https://support.leadspace.com/hc/en-us/articles/360000827409-API-v4-OAuth-2-0-Diagram - id: oidc-v4-gateway conforms: false applies_to: https://apigw.leadspace.com evidence: No OpenID Connect discovery document or ID token surface on the v4 REST gateway. - id: rfc6750-bearer-token conforms: true evidence: "Authorization: Bearer API_KEY header on every API request." - id: rfc7159-json conforms: true evidence: >- Docs explicitly cite RFC 7159 as the JSON data format for all requests and responses. - id: iso8601-datetime conforms: true evidence: Dates and timestamps are ISO 8601 in UTC, e.g. 2015-05-03T15:38:45Z. - id: rfc9457-problem-details conforms: false evidence: >- Errors use a proprietary JSON envelope (error, tracking_id, request_timestamp, details), not application/problem+json. - id: rfc8594-sunset-header conforms: false evidence: >- Deprecation is communicated by the Integration Manager out of band; no Sunset or Deprecation headers are documented. - id: rfc9116-security-txt conforms: false evidence: /.well-known/security.txt returns 404 on leadspace.com and apigw.leadspace.com. - id: idempotency-key conforms: false evidence: >- No idempotency key documented; external_id and external_bulk_id are correlation-only and explicitly not used for processing. - id: http-429-rate-limiting conforms: true evidence: Rate limit breaches return HTTP 429 per the tiered TPS SLA. - id: webhooks-callbacks conforms: true evidence: >- Bulk enrichment and discovery accept an optional callbackUrl and POST a documented completion payload to it. - id: naics conforms: true evidence: >- Company records carry naics and naicsDescription; industry is derived from NAICS identifier and classification. - id: sic conforms: true evidence: Company records carry a 4-digit sic identifier and sicDescription. compliance: published: true url: https://www.leadspace.com/platform/security-and-compliance statement_url: https://support.leadspace.com/hc/en-us/articles/360012276859-General-Statement-of-Information-Security-and-Privacy trust_center: security/leadspace-trust-center.yml last_reviewed: '2025-11' certifications: - name: ISO 27001 status: certified note: >- Information Security Management; backed by certifications and annual audits per the published statement. - name: SOC 2 Type II status: audited note: >- SOC 2 reports available for customer review under confidentiality arrangements. regulatory_programs: - name: GDPR status: program established note: >- Comprehensive compliance program supporting customers' GDPR needs; standard DPA offered alongside the Software Service Agreement. Leadspace acts as processor / service provider and states it processes no special categories of data. - name: CCPA and US State Consumer Privacy Laws status: program established docs: https://support.leadspace.com/hc/en-us/articles/360006146040-CCPA-Compliance note: >- Opt-out of mailing lists, of third-party sharing, and of sale of personal information via a dedicated form. - name: Texas Data Broker registration status: disclosed docs: https://www.leadspace.com/texas-data-broker-notice controls: - Customer data fully encrypted in transit and at rest. - Third-party information security audit and penetration test summaries available on request. - Hosted on Google Cloud Platform with its own attestations of compliance. - Onboarding and annual security and privacy training for all personnel. - Standing privacy team; counsel holds CIPP/US, CIPP/E, and CIPM.