BYOK & Zero-Knowledge Architecture
We built Lead Machine so we would trust it ourselves. Here is exactly how your secrets stay yours.
BYOK & Zero-Knowledge Architecture
We built Lead Machine so we would trust it ourselves. Here is exactly how your secrets stay yours.
All API keys you paste into Lead Machine (Gemini, Groq, SMTP user/pass) are encrypted in your browser BEFORE anything else happens.
We use the browser's native Web Crypto API — zero third-party crypto libraries. The implementation is auditable in lib/crypto.ts.
Step-by-step encryption flow
A 16-byte cryptographically-random salt is generated per payload (crypto.getRandomValues).
A 12-byte random IV (initialization vector) is generated per encryption — non-repeating, GCM-compliant.
Your browser fingerprint (UA+lang+platform+resolution+timezone+cores+memory) is used as the passphrase.
PBKDF2 with SHA-256 stretches that passphrase over 100,000 iterations into a 256-bit AES key.
AES-GCM 256 encrypts your keys. The auth tag is included in the ciphertext (GCM property).
Salt + IV + ciphertext + iteration count are base64-encoded and JSON-stringified. Result stored ONLY in your localStorage.
git clone https://github.com/AxsenXzc/lead-machine.gitReady to own your pipeline?
Deploy Lead Machine on your laptop in 3 commands — or self-host it anywhere. Free forever, no sign-up, no credit card.