Privacy and Security

Effective date: October 5, 2026

Your business runs on the data you keep in Marketercore: your contacts, conversations, calls, invoices and documents. Protecting it is part of the product, not an add-on. This page describes the practices Marketercore Ltd commits to. We align our controls with widely recognised security frameworks and continue to improve them over time.

Encryption

• In transit. All traffic between your browser or mobile app and the Service is encrypted with TLS. Connections to our payment, telephony, email and AI providers are also encrypted.
• At rest. Data is stored on encrypted infrastructure. Secrets and especially sensitive fields, such as integration tokens, API keys and multi-factor secrets, are additionally encrypted at the application level with AES-256-GCM.

Accounts and sign-in

• Password hashing. Passwords are never stored in plain text. They are hashed with scrypt, a memory-hard algorithm designed to resist brute-force attacks.
• Multi-factor authentication. You can protect your account with an authenticator app (time-based one-time passwords, TOTP), along with single-use backup codes in case you lose your device. Account owners can require it for their team.
• Rate limiting and lockout. Repeated failed sign-in attempts are rate limited and can temporarily lock the account to stop password-guessing attacks.
• Session management. Sessions use secure, HTTP-only cookies and expire after inactivity. You can review active sessions and sign out of other devices.

Access control

• Role-based access. Owners decide exactly what each team member can see and do, with granular permissions for areas such as contacts, conversations, calls, payments and settings.
• Role groups. Permissions can be grouped into reusable roles so teams stay consistent as they grow.
• Least privilege. Our own staff access customer data only when needed to provide support or keep the Service secure, and only with the minimum access required.
• Audit logs. Important actions, such as sign-ins, permission changes, exports and deletions, are recorded in audit logs so you can see who did what and when.

Payments

Card payments are handled by Stripe, a PCI DSS Level 1 certified payment processor. Card numbers are entered directly into Stripe's secure systems and never touch or are stored on our servers. We keep only limited details, such as the card brand and last four digits, so you can recognise a payment method.

Integrations and webhooks

• Connections to third-party services use each provider's official authorization methods, and the resulting credentials are encrypted at rest.
• Incoming webhooks from providers such as payment processors and telephony carriers are verified using their signatures before they are processed, so forged events are rejected.
• You can disconnect an integration at any time, which revokes our stored access.

Backups and reliability

The database is backed up automatically every day. Each backup is encrypted with AES-256-GCM before it is stored. Daily backups are kept for 14 days and weekly backups for 8 weeks, then deleted. An encrypted copy of each backup is also stored off-site, with a separate storage provider. We monitor the Service for errors and unusual activity and work to restore service quickly if something goes wrong.

AI and communications

AI features process only the information needed to generate a reply or summary. We use AI providers under terms that prohibit using your data to train their models. Call recordings and transcripts are stored with the same protections as the rest of your data, and you control whether recording is turned on.

Your data, your control

• Export. You can export your contacts and other key data at any time.
• Deletion. You can delete records in the Service, and you can ask us to delete your account and its data by contacting support@marketercore.co.uk. We will confirm the request and complete it within the time required by law, except for information we must keep for legal reasons.
• Requests from your contacts. If one of your contacts asks to access or delete their information, we will help you respond.

For more on how we collect and use information, please read our Privacy Policy.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please contact support@marketercore.co.uk with a description, steps to reproduce and any supporting details. Please give us reasonable time to investigate and fix the issue before sharing it publicly, and do not access or change data that does not belong to you, disrupt the Service or use social engineering. We will not pursue legal action against good-faith research that follows these guidelines.

Reporting a concern

If you notice suspicious activity on your account, think your password or device has been compromised, or have any privacy or security question, contact support@marketercore.co.uk right away. We recommend changing your password and reviewing your active sessions in the meantime. If we become aware of a security incident that affects your data, we will notify you without undue delay and in line with applicable law.

You can contact Marketercore Ltd by email at support@marketercore.co.uk. Our postal address is: 128 City Road, London EC1V 2NX. Company number: 13420440. You can also find more information on marketercore.co.uk.