Are Your Leads Safe in Someone Else's Database? A Real Estate Agent's Guide to CRM Data Security

Every lead you've ever paid for, chased or been referred is a phone number, a budget and a reason to buy. Put together, that list is your business. So it's a fair question: when your leads sit in someone else's database, are they safe?

The honest answer is that big cloud CRMs are generally well protected, and on paper you own your data. But "someone else's database" means more people, more connected apps and more rules you don't control. This guide quotes what the vendors themselves say, looks at how CRM data actually got stolen in recent years, and explains when keeping leads on your own phone is the safer choice. We make an on-phone CRM, so we're biased. That's why every claim about another company below links to its own page or to a named report.

Who owns your leads in a cloud CRM?

You do, according to the terms of every major vendor we checked on 22 October 2026:

• HubSpot: "You own and retain all rights to the Customer Materials and Customer Data." (Terms of Service)
• Salesforce: it "acquires no right, title or interest" in customer data. (Main Services Agreement)
• Zoho: "We recognize that you own your service data." (Privacy Policy)
• Sell.Do, an Indian real estate CRM: "You retain all rights of ownership." (Privacy Policy)

That's good news, and it's the norm. But ownership is a legal right. It doesn't decide who can reach the data, what it's used for, or how long it survives once you stop paying. Those are the questions that matter.

Who else can see them?

Running a cloud service means some of the vendor's people and partners can reach customer data, under controls. The better vendors say so plainly:

Three more parties can touch cloud data:

• Sub-processors, such as the hosting company and email providers.
• The apps you connect to your CRM.
• Authorities. Zoho's policy notes it "may be required by law to preserve or disclose" data.

None of this means anyone is misusing your leads. It means your list lives in a system with many doors, and you depend on someone else to guard them well.

What happens when you stop paying

This is the risk agents most often miss. A lapsed card or a cancelled plan starts a deletion clock:

The lesson is simple: export a full copy of your leads before you cancel, switch or let a trial or plan lapse. And keep exporting regularly, because "we'll do it later" is how agents lose years of contacts.

How CRM data actually gets stolen

When people imagine a CRM breach, they picture hackers breaking the CRM itself. The biggest recent case worked differently.

The 2025 Salesforce-customer data thefts. In 2025, criminal groups stole data from many companies' Salesforce accounts. Google's threat intelligence team documented two methods:

• Phone calls to staff. Attackers posed as IT support and talked staff into connecting a modified data app. "Attackers relied on manipulating end users, not exploiting any vulnerability inherent to Salesforce." (Google Threat Intelligence)
• A connected third-party app. Login tokens were stolen from Salesloft Drift, a chat tool connected to Salesforce, and used to "systematically export large volumes of data" from many companies' Salesforce accounts in August 2025. Google says this didn't come from a weakness in Salesforce's core platform. (Google Threat Intelligence) The press counted more than 700 affected organisations. (TechTarget)

The pattern matches the wider data. Verizon's 2025 Data Breach Investigations Report found third-party involvement in breaches doubled to 30%, and credential abuse was a leading way in, at 22%. (Verizon DBIR 2025)

Databases left open. Sometimes no one has to break in at all:

• Dubai, 2023. Researchers found an unprotected database with about 690,000 records of real estate customers: names, phone numbers, emails and scanned IDs. It was likely linked to property-management software Goyzer and has since been closed. (Security Affairs / Cybernews)
• United States, 2023. A non-password-protected database at Real Estate Wealth Network exposed over 1.5 billion property records. (Bitdefender)

The takeaway for agents: the weak points are usually people, passwords and connected apps, not the CRM's code. Every extra login and integration is another door.

The ex-employee problem

For brokerages, the most common "leak" isn't a hacker. It's an agent leaving with access they still have.

In a survey of 1,000 US adults published in October 2026, 64% said they could still reach sensitive company information after leaving a job, and 29% named customer or client information. (Sagiss survey via GlobeNewswire)

Shared team logins make this worse. When five people use one password, you can't remove one person without changing it for everyone, so it never gets changed.

The leak nobody talks about: portals

If you buy leads from property portals, remember that the buyer's details pass through the portal first, and its terms decide where they go next.

99acres. Its terms, effective 20 March 2026, say:

• A buyer who enquires authorises 99acres to contact them "even though you may have registered with NDNC/DNC".
• The buyer consents to their data going "to such Advertisers/service providers and others, who may further contact you".
• The privacy policy "does not govern the use of your data by third parties once it is shared".

(99acres terms)

Housing.com. Its privacy policy says "We send leads to REPs on your behalf", where REPs are real estate professionals. It also says it makes visitors' email addresses "available to other reputable organizations". (Housing.com privacy policy)

This is how portals work, and it's disclosed. But it means a portal enquiry is rarely yours alone. Once a lead is in your hands, the notes, follow-ups and relationship you build are what make it yours. That history is worth protecting more carefully than the raw number.

The other option: keep leads on your own phone

An on-phone (offline-first) CRM takes the vendor's database out of the picture. Here's exactly how our app, Boring CRM, handles it. We list the parts that do use the internet too.

What stays on your phone

• All your CRM data stays on the phone: leads, follow-ups, notes, call history, attachments and quotations. None of it is uploaded to Boring CRM servers.
• There's no account. You don't sign up, so there's no login or password to phish, share or forget to revoke.
• No automatic Google Drive copy. The app opts out of Android's automatic app backup, which would otherwise copy app data to the user's Google Drive. (Android Auto Backup)
• No vendor deletion clock. If you stop paying for Remove Ads, nothing is deleted. Every CRM feature is free, so there's no plan to lapse.

What does use the internet

• Anonymous usage analytics (Google Analytics for Firebase). These are counts, such as how many leads you have, never lead names or numbers.
• Google ads in the free version.
• Firebase for support chat, push notifications, optional offers and subscription checks.
• Support chat messages you type are sent to us, so don't paste client details into them.
• Facebook Lead Ads sync downloads leads from Meta, where they already are.

The honest trade-offs

• Your phone becomes the vault. India has blocked over 42 lakh lost or stolen phones through Sanchar Saathi. (PIB) Phones launched with Android 10 or later encrypt app data, but it stays protected only while the phone is locked. (Android) A screen lock is essential.
• Backup files are readable. Boring CRM saves full backup files that anyone with the file can open. It doesn't add its own encryption layer to the app's data or to backups.
• No team sharing. Each phone has its own leads. If a manager needs everyone's pipeline in one place, you need a cloud CRM.

Cloud CRM vs on-phone CRM: the security trade-off

A 10-point lead security checklist (any CRM)

A note for agents in India: the DPDP Rules

India notified the Digital Personal Data Protection Rules in November 2025, which the government called "the full operationalisation of the DPDP Act, 2023". (PIB) The core duties apply after an 18-month transition. They require:

• a clear purpose for the personal data a business collects;
• reasonable security safeguards, which the Rules list as encryption or masking, access control, logs and backups;
• telling affected people and the Data Protection Board about a breach without delay, with a detailed report within 72 hours.

Whatever CRM you use, the habits in the checklist above point the same way. If you run a brokerage, ask a qualified advisor how the Rules apply to you.

So which is safest for your leads?

For a team that needs shared leads and manager oversight, a reputable cloud CRM with two-step login, individual accounts and few connected apps is the right choice. Read its terms on staff access, AI use and deletion.

For a solo agent or small office working from Android phones, an on-phone CRM removes the risks you can't control: someone else's database, someone else's staff, a deletion clock and shared passwords. What's left is risk you can control: your phone lock and where you keep your backup file. That's the trade Boring CRM is built on, and it's free, with every feature and no lead limit.

Sources checked on 22 October 2026: vendor terms and policies linked above (HubSpot Terms of Service, DPA and Product Specific Terms, all modified 16 Sep 2026; Salesforce MSA and SPARC, October 2026; Zoho Privacy Policy, updated 22 Dec 2025; Sell.Do Privacy Policy, June 2026; LeadSquared Security page). 99acres terms effective 20 Mar 2026 and the Housing.com privacy policy, read via archived copies from October 2026. Google Threat Intelligence reports of 5 Jun 2025 and 27 Aug 2025. Verizon DBIR 2025. PIB releases of 14 Nov 2025 and 2 Dec 2025. Policies change. Check the current versions before relying on them.

Frequently asked questions

Who owns my leads in a cloud CRM?

You do, according to the terms of every major vendor we checked: HubSpot, Salesforce, Zoho and Sell.Do. Ownership doesn't stop the vendor's staff and sub-processors from accessing data under their own controls. It also doesn't stop the vendor deleting the data after your account ends. Read the terms, not just the marketing page.

Can a CRM company see my leads?

Usually some staff can, under controls. HubSpot says a subset of its employees can access customer data through controlled interfaces. Zoho says employee access is restricted to specific people and is logged and audited, and support staff can see whatever you share with them. With an on-phone CRM like Boring CRM, lead records aren't uploaded to the app maker's servers, so there's nothing there for staff to see.

Do cloud CRMs use my data to train AI?

It depends on the vendor, so check. HubSpot's terms say it may use customer data to train its AI models, and you can opt out in your account settings. Salesforce says it does not currently use customer data to train generative AI. Zoho describes limited uses, such as anonymised data and models specific to your organisation.

What happens to my CRM data if I stop paying?

Each vendor has its own timeline. Salesforce lets you request your data within 30 days of termination, then deletes it in stages. HubSpot says free and Smart CRM users get no access after termination. Sell.Do deletes all data 14 days after termination. Always export a full copy before you cancel or let a plan lapse.

Is an offline CRM more secure than a cloud CRM?

It removes some risks and adds others. There's no vendor database to breach, no shared login to leak and no vendor deleting your data. But your phone becomes the vault. Use a screen lock, the app lock and remote erase, and treat backup files like a printed client list. For teams that need shared leads, a well-run cloud CRM with two-step login is the better fit.

Are Boring CRM backups encrypted?

No. Backup files are readable files saved to your phone's Downloads folder. Anyone who gets a copy can read the leads in it. Keep them in a private place, such as your own Google Drive or a USB drive, and never post them in group chats.