Agency access, user permissions and sharing controls are checked by the server. These protections help keep client work within its intended audience.
Signing in does not by itself grant access to an agency. Workspace membership and permissions determine which records and actions are available. Project and campaign checks also apply to requests made directly to the server, not only to controls shown on screen.
Sensitive account and administration actions require recent authentication. API tokens have defined capabilities and can be revoked; they do not provide the same authority as a signed-in person. Browser calling credentials are restricted to authenticated user sessions.
Sensitive database fields use application-level encryption before storage. Stored attachments use an encrypted file envelope. These are targeted protections, not a claim that every database column is encrypted.
HTTPS protects connections to the public service. Browser security policies restrict which resources the application can load and where it can be embedded.
Managers can choose the project scope of dashboard-share links and set expiry and password controls. A share link gives access to its reporting view, not an agency account. Treat links and passwords as confidential and revoke a link when access is no longer needed.
Assign access to the people who need it, keep connected-provider accounts secure and review sharing settings before distributing a link. Calling, email, retention and lawful use of prospect information remain decisions for your organisation.
Email support@prospexe.co.uk with a description of the concern and the affected page or workflow. Do not include passwords, API tokens or customer records.
