Security & trust
The five things Realtors get burned on — and our answer to each.
Your leads are exclusive. The bill has no surprises. Your data exports on demand. We won't change the rules under you. The AI doesn't message your leads without your sign-off. Everything else on this page is the work behind those five.
When a lead completes our home-value qualification, the system marks the lead as delivered to your account. For 12 months after delivery, no other Realtor on Turnkey Leads can see or contact that lead.
Exclusivity is enforced at the data layer — not by a sales policy that could be bent. The system can't show the same lead to a second Realtor because it isn't there to show. If the same homeowner clicks another agent's TKL-served ad within those 12 months, they still route back to you.
No "share-of-voice" auction. No "1 of 3 agents" rotation. No "Flex tier" where the same lead goes to 5 competing offices.
#1 — Exclusivity
12-month exclusivity, data-layer enforced.
The Realtor who funded the lead is the only Realtor who gets the lead for the full year.
#2 — Hidden fees & cancellation
No surprise charges. Cancel before the next bill. We never hold your money.
No annual contract, no auto-renewal trap, no buyout fee, no "cancellation specialist."
The monthly bill preview lands 5–7 days before each charge with the exact figures. Stripe never sees a number you haven't already seen. Cancel before that preview goes through and the next charge is never created.
The money moves card-direct through Stripe to Google and Meta for ad spend, and to us for the Service Fee. No prepaid balance to top up. No deposit. No escrow. If you cancel, there's nothing for us to refund — because we never had your money.
Your monthly budget is a hard cap. If the AI sees an opportunity to spend beyond it mid-month, it stops and asks for a fresh authorization. Over-spend is mathematically impossible.
Lead data belongs to your account, not to TKL. One-click CSV export of every contact — name, phone, email, address, notes, source, status, conversation history. Importable into any standard real-estate CRM.
No offboarding fee. No "premium tier" to unlock your own data. No "we keep the leads, you keep the memories" routine. The export works during your active subscription and during a wind-down window after you cancel.
We own the ad infrastructure because that's what makes the AI work — but the lead data is yours, and we have no incentive to contact your leads on our own. We never will.
#3 — Data ownership
Your leads. Your data. Exportable any time.
You take everything when you leave. Including conversation history, not just a flat contact list.
#4 — Continuity
We won't rewrite the rules under you.
Founder-owned, independent, not VC-pressured into an exit. If that ever changes, your data and pricing terms travel with you.
Pricing changes are telegraphed 30+ days in advance via the monthly bill preview. Material changes need your explicit click — silence is approval only on a plan that hasn't changed.
If we ever get acquired, your data-export rights survive in the acquisition terms. We won't quietly reclassify your leads as "mutual customer data" with a new owner. (This is the move that triggered the industry-wide Zillow-Follow-Up-Boss exodus in late 2025; we wrote our terms specifically to make it impossible.)
If we ever shut down, you get 90 days of read-only access plus export before the lights go off. No surprise loss of years of contact history.
The AI runs your campaigns and drafts personalized replies — but never sends a text or email to a lead without your sign-off. You hit Send or edit before anything goes out.
TCPA, CAN-SPAM, Fair Housing, and state mini-TCPA gates run before any campaign creative goes live and before any outreach is dispatched. Consent and suppression evidence is retained per lead — opt-outs (STOP, STOPALL, OPTOUT, REVOKE, etc.) are honored across the entire system, not per-channel or per-campaign.
If you face a TCPA challenge or a Fair Housing complaint, we hand over the consent/opt-out evidence package for your defense. Vicarious liability under the FCC's January 2025 one-to-one consent rule is real; we built the gates specifically because of it.
#5 — AI outreach safeguards
The AI doesn't message your leads without your sign-off.
Drafts, not auto-sends. Compliance gates before every outbound. Evidence package on demand.
Also worth knowing
A few more things worth knowing.
Sign-in is passwordless.
A one-time SMS code, or verified-email backup when your phone isn't handy. No password to forget. No password to leak.
TKL staff can't see your account by default.
When we need to help with something, you see the access request and the time-boxed window in your audit log. There is no "support read everything" mode running quietly in the background.
Your ads run in their own account.
Each customer gets a dedicated Google and Meta ad account plus a dedicated Pixel. Another customer's policy violation, payment failure, or suspension can't ripple into yours.
Personal information is stored separately.
Names, phones, exact addresses, and form submissions are kept apart from our regular business records, each with its own deletion lifecycle. CCPA and multi-state right-to-delete supported, with carve-outs for legally required retention (TCPA logs, real-estate records).
Posture
What's under the hood.
Customer data lives on SOC 2 Type 2-attested infrastructure with AES-256 encryption at rest, TLS 1.2+ in transit, region-pinned managed Postgres with point-in-time recovery, and PCI-DSS-Level-1 payment processing. Raw card data never touches our servers.
Everything that makes this product different — passwordless auth, step-up for sensitive actions, the SupportSession boundary, customer-isolated ad accounts, the Personal Data Vault with crypto-shred deletion, and the TCPA/Fair-Housing gates before any customer-contact outreach — sits on top of that foundation. Those are detailed in the sections above.
- – SOC 2 Type 1 for TKL is on the roadmap. We don't claim attestations we don't hold. Until ours lands, the sub-processors that store customer data each carry SOC 2 Type 2.
- – CCPA + multi-state right-to-delete honored with retention carve-outs for TCPA and real-estate-record obligations.
- – Full sub-processor list, DPA, security overview, and SOC 2 letters from our sub-processors: email security@turnkeyleads.com.
- – Security issue? Same email. Responsible-disclosure timelines and PGP key on request.
See the proposal before you pay.
Free setup, no card, no commitments. If you never approve the first monthly bill preview, you're never charged.