Where Ghost Intake data lives

Each firm gets its own installation, and nothing in one can reach another. What they share is us, as invited members.

Cloudflare Durable Objects run each lead's wrap-up timer and the rate limits, and hold no contact details or answers.

All of it is stored in the database, and nothing is added from outside sources. The per-browser ID is linked to the lead if that browser submits.

The public side

The prospect-facing API accepts contact steps and answers. It returns nothing but the visitor's own place in the questions, to the browser holding their session token.

That token is random (128 bits), lasts four hours and is stored only as a SHA-256 hash. It leaves the address bar before any analytics tag can read it. No personal information travels in URLs.

The dashboard

Sign-in takes an address on your allow-list and a one-time code that Cloudflare Access emails to it. The allow-list is your firm's domain plus any addresses you add, as the Access policy in your Cloudflare account shows. Sessions last 24 hours by default.

The dashboard checks the sign-in token again in its own code. There are no separate roles: everyone signed in sees every lead and can delete leads.

Our access

We work in your accounts as invited members to install, maintain and monitor the system, and that access lets us see lead data. You can remove us in each provider's settings and from the allow-list.

Our uptime monitor checks the pages and backups from outside, and operational alerts come to us.

Audit entries keep the person's email address and the time, and are never purged. Deletion entries leave out the prospect's name and phone. Application logs are written to hold no personal information, with tokens redacted.

Visitor IP addresses are stored only as a keyed hash (HMAC). TLS protects the connections from the browser to Cloudflare, and from the Worker and dashboard to the database and Lead Docket. The providers encrypt the database and backups at rest.

Ghost Intake doesn't add an encryption layer of its own. Inside the database and the backups, contact details and answers are ordinary records, protected by provider encryption and by who can reach the accounts. Notification emails travel under your mail system's own rules.

It never emails a prospect. The email service and the code both refuse any address that isn't on the allow-list. Mail goes out from its own subdomain, leaving your main email records alone.

Tags you already run collect whatever they're set to, and some, such as Google's automatic collection of user-provided data, can read form fields. We review them with you at installation.

Five years. Leads and form-view records are deleted automatically after 1,825 days. The purge is set in the code, the same for every installation. Until then, the consent record is there if a call or text is disputed.

Deleting can't be undone from the dashboard. A dashboard deletion removes the lead from the database. Copies in Lead Docket and your mailboxes follow their own retention.

Nightly backups. Each is read back and counted the same night, and a bad one raises an alert. Each is locked against deletion and overwriting for 30 days. The lock is a rule on the backup bucket in your Cloudflare account. An account admin can remove it.

Backups outlast deletions. A backup written before a deletion still holds that lead, and restoring it brings back leads deleted since. Restores follow a written procedure.

Deliveries to Lead Docket and email wait in a queue in the database, and the lead stays there if one fails. A failed delivery is retried after 1, 2, 4, 8 and 16 minutes, then set aside, and we're alerted.

We're also alerted when the database can't be reached, a lead isn't wrapped up on time, or the form stops being seen.

Every submission goes through Cloudflare Turnstile, a honeypot field people never see, a minimum time on the form and rate limits. A visitor who fails Turnstile is asked to try again or call. If Turnstile is unavailable, the lead is accepted and marked unchecked, and we're alerted.

• This page describes how Ghost Intake is built and run. It isn't a certification or an outside audit, and the system hasn't had a formal penetration test.
• We don't describe Ghost Intake as compliant with any law or standard. Whether your intake meets your consent, advertising and privacy rules is your firm's call.
• It can't delete anything in Lead Docket or your mailboxes, and it doesn't control what your own tags collect.