Your lead list
never leaves the walls.
The customer data you paid for stops living in a spreadsheet anyone can forward. Every lead sits inside Datafort, assigned to one person, with every view on the record — and there is no export button to press.
Browser-based. Nothing for your reps to install.
A lead list is an expensive file, and a file can be copied.
Most small sales teams run on a spreadsheet. That sheet holds the customer data the business was built on — and it is still just a file, sitting on a laptop, one attachment away from a competitor.
Everyone sees everything
One sheet, shared with the team. A rep hired last week can open all ten thousand rows on their first afternoon.
It leaves in one click
Mail it, sync it, drop it on a pendrive. Nothing records that it happened, and nothing points back at who did it.
DLP suites price you out
Enterprise data-loss tools guard the file without understanding the data — and cost far more than a small team can justify.
Datafort doesn't protect the spreadsheet. It removes it.
Leads live inside a controlled application. An admin governs who sees what, a rep only ever holds the slice of the list they are working today, and every read and every write goes into an append-only log. What you are buying is not lead management — it is the guarantee that the list you paid for does not walk out the door.
Four steps from spreadsheet to sealed
No migration project and no agent on anyone's laptop. Import the sheet you already have and start assigning.
Import the sheet
Upload Excel or CSV, map the columns once, and let Datafort validate and de-duplicate the rows on the way in.
Assign the work
Give each rep a daily book of leads. Assignment is the containment: a rep can never see the leads they were not given.
Reps work under quota
Contacts stay masked. Revealing one is a deliberate, logged click that spends part of a daily allowance the admin sets.
You watch the signal
The dashboard shows reveals against contacts made, flags unusual bursts, and keeps the full trail for when you need it.
Built into Datafort today
A complete operating layer for controlled lead access — from import and assignment through outreach, monitoring and forensic accountability.
Phone numbers and email addresses display masked. The full value appears only when an authorised rep deliberately reveals it.
Sign-ins, reveals, assignments, status changes and relay emails are recorded with the actor, the timestamp, the IP and the device.
Per-rep reveal quotas and daily lead targets keep access proportional to the work. A rep capped at forty a day cannot drain ten thousand rows.
Import in bulk, remove duplicates automatically, assign daily books, and reassign or recall access without ever exporting the source list.
A revealed contact comes back as an image with the viewer's identity rendered into the same pixels. Cropping the watermark out crops the data out.
Reps compose follow-ups in-app and Datafort sends them server-side. The rep never possesses the address, and the message stays on the record.
mTLS certificates restrict sign-in to laptops you have enrolled, and a session stays bound to the device that created it.
Decoy leads seeded into each rep's book identify whose copy leaked, and burst-reveal monitoring surfaces suspicious access while it is happening.
Three layers, and we are clear about what each one is worth.
Containment is enforced on the server, where developer tools cannot reach it. Attribution makes a leak traceable back to a person. Device trust decides which machines get to try at all.
- No export endpoint was ever built, so there is none to disable, bypass or forget to lock down.
- Reps see only their assigned leads. Ownership is checked before a record is even confirmed to exist.
- Reveal quotas are re-counted server-side on every call, never trusted from the browser.
- Raw email addresses never reach the client; outreach goes through a server-side relay.
- The ledger row is written before the value is rendered, so a look cannot happen off the record.
- Watermarks are baked into the returned image, not overlaid in the page where they could be deleted.
- Unique decoy leads are seeded into each rep's assigned set. If the list surfaces elsewhere, the decoys name the source.
- Anomaly alerts fire on unusual reveal rates, odd-hour access and sign-in from an unfamiliar device or IP.
- Mutual TLS certificates mean an unenrolled laptop cannot reach the sign-in form, let alone the data.
- Sessions are bound to the device that created them, so a copied cookie is worth nothing elsewhere.
- Roll out in stages: log new devices first, enforce once you can see the whole fleet.
- Revoke a laptop from the admin panel and it stops working on the next request.
Where we draw the line. Browser-side hardening — disabled selection, blocked shortcuts, print suppression — is a deterrent, not a guarantee, and we describe it that way. Someone determined enough with developer tools can defeat any of it. That is exactly why the controls that matter live on the server, and why every reveal is attributable to a person and a device.
Two roles, and one of them can never see the whole list.
Admin
Owns the list and decides who touches what
- Imports leads from Excel or CSV with column mapping and de-duplication
- Assigns, reassigns and recalls leads at any time
- Sets a daily lead and reveal quota per person, not one global number
- Enrols and revokes company laptops
- Reads the full audit log and the live dashboard
Sales rep
Works today's book and nothing beyond it
- Sees only the leads assigned to them
- Reveals a contact when they need it, within their daily allowance
- Updates status, logs calls and adds notes on the record
- Emails a lead through the relay without ever holding the address
- Cannot export, cannot bulk view, cannot see unassigned leads
Every plan gets the same core promise
Masked contacts, a logged reveal for every look, and no export to walk away with — on all three. Plans differ in how deep the device-level security goes and how isolated your data is from every other customer.
- Masked contact reveal with a per-rep daily quota
- Every reveal logged in an append-only audit trail
- Watermarked reveal images, tied to the viewer
- Bulk import with automatic de-duplication
- Follow-up email relay, never the rep's own inbox
- Company-laptop device binding
- Seeded decoy leads (honeytokens)
- Everything in Starter
- mTLS device certificates — only enrolled company laptops sign in
- A session is bound to the device that created it
- Seeded decoy leads, so a leaked list identifies itself
- Burst-reveal anomaly alerts
- Staged rollout — log new devices before you enforce them
- Priority support
- Everything in Growth
- Your own dedicated database — never shared with another customer
- Your own private certificate authority for device trust
- Dedicated subdomain and Apache vhost
- Custom device-enforcement policy for your rollout
- SLA-backed support and guided onboarding
- Negotiated data-retention terms
Not sure which one covers you? See the full pricing page or .
The things people ask first
Can a rep really not export anything?
There is no export endpoint in the backend. It was never built, so there is nothing to disable and nothing for developer tools to call. A rep can read the leads assigned to them, one record at a time, within their daily quota — that is the whole of the surface.
What stops someone photographing the screen?
Nothing stops the photograph, and we would not claim otherwise. What we do is make it useless as an anonymous act: a revealed contact is returned as an image with the viewer's name, ID and timestamp rendered into the same pixels. The photo identifies exactly who took it.
How would you know which rep leaked a list?
Each rep's assigned set is seeded with unique decoy leads that borrow the look of your real data — same city, same industry, same source — but carry deliberately unreachable contact details. If your list turns up at a competitor, the decoys in it name the copy it came from.
Do we have to lock reps to company laptops?
Not on day one. Device certificates are available from the Growth plan and can be rolled out in stages — Datafort logs the devices signing in first, so you can see your fleet before you start enforcing. Turn enforcement on once the list looks right.
How does a rep contact a lead without the address?
They compose the message inside Datafort and the server sends it through a relay. The raw address never reaches the browser, the rep's own inbox is never involved, and the message is written to the audit trail like any other action on the record.
Can reps use it on a phone?
No, by design. The application turns away phones and tablets — lead data does not belong on a personal device that leaves the building. This page and the pricing page are the exception, since a prospect reading about the product is not a risk.
How do accounts get created?
Only by your administrator. There is no self-registration anywhere in the product; an open sign-up form would be a hole straight into somebody else's lead data.
Is our data mixed in with other customers'?
Starter and Growth run on shared, tenant-isolated infrastructure. Enterprise gets its own dedicated database, its own private certificate authority and its own subdomain and vhost — separate from every other customer.
Find out what it would take to seal your list
Tell us how many reps you have and how your laptops are managed. We'll tell you the smallest plan that actually covers you — including if that plan is none of ours.