Built to pass a security review, not skirt one.
These are the questions compliance and security teams put to us, with the answers we give them.
What we hold, and what we never do
Mahleon runs through your own logged-in LinkedIn session, in your own browser. We never see or store your LinkedIn password, and we store no LinkedIn cookies. The CRM check runs the same way by default, with nothing stored at all. A firm that connects Salesforce directly instead issues us a token, which we hold encrypted per organisation and which the firm can revoke in Salesforce without our involvement.
Lawful first contact
Every opener states where you found the person: the GDPR Article 14 disclosure, built into the message, not left to the user to remember.
Signed lawful basis
Before Mahleon finds anyone, you sign a Legitimate Interest Assessment. We provide the template and record your signature and version.
CRM screening
Connect a CRM and Mahleon looks people up against it before you approach them, so anyone already a client, lead, or at a company you have an open opportunity with can be held back. A firm chooses whether a missing answer holds someone or lets them through.
Approval workflow
Templates route through your compliance sign-off. Only approved copy can be used in a campaign; supervisors get oversight of what goes out.
Tamper-proof audit trail
Every planned and executed action is written to a hash-chained, exportable log of who was contacted, when, with what, and who approved it.
Data residency
Your records and campaign data live on UK and EU infrastructure. Your CRM is read in your own browser and never reaches us. The one exception is transactional email — sent from Ireland, with delivery logs held in the US by our email provider; those carry a recipient address and a subject line, never a prospect's details.
Per-user isolation
Every user's connections, data and results are scoped to their own organisation and enforced in the database, so one firm's data is never visible to another.
Account-safe by design
Human-paced sending, conservative daily caps while an account warms up, and a hard stop the moment someone replies, engineered to protect the account, not risk it.
“Do you store our CRM credentials?” Only a token you can revoke.
It's the question every regulated firm's security review asks, and the honest answer is better than a clean one. By default the CRM check runs through the adviser's own authenticated session, the same way they'd use Salesforce themselves, and nothing is stored. A firm that chooses to connect Salesforce directly issues Mahleon a refresh token, held encrypted and per organisation, which the firm can revoke in Salesforce at any time without asking us.
Where a firm's own connected-app policy blocks that, a per-user sign-in is held the same way, used only by exception and disclosed at the point of use. On every route, no LinkedIn credential is ever stored.
What you can tell compliance
- “What's our lawful basis?” A signed LIA on file.
- “Did we disclose where we found them?” Yes, in every first message.
- “Who approved this copy?” Named, dated, logged.
- “Did we contact an existing client?” The record shows exactly who was approached and when. Connect a CRM and Mahleon checks people against it first.
- “Show me everything we sent.” One export.
Outreach your firm can defend.
Start a free trial, or send this page to your compliance team first. That's rather the point.