End to End Security Embedded In All Workflows Security is Top Priority For Us
Level AI satisfies the requirements for GPDR, HIPAA, PCI and ISO 27001 compliance
KEY SECURITY FEATURES
Level AI prioritizes customer privacy. Sensitive information like name, addresses and credit card numbers are automatically redacted
We closely work with the security researchers to identify any vulnerabilities in our application and infrastructure using guidelines from the OWASP Application Security Verification standard and ISO27001
We limit access to data by role based access control (RBAC) with audit logs. Access to customer data follows the principle of least privilege.
Level has policies around secure development lifecycle (SDLC). Code reviews are mandatory, and every developer is required to learn and apply the best security practices.
All customer data is encrypted both at rest and during transit. The data passed between Level and third party applications is always encrypted.
Our GCP based infrastructure is secured using rigorous vulnerability testing. Access to servers is resources is managed by the principle of least privilege using IAM policies.
Level is PCI Compliant -it has met all the criteria for securing and protecting cardholder data and has been audited for it.
Frequently asked questions
Our Infrastructure is hosted on GCP, and we meet the requirements of a number of certifications that ensure the confidentiality, security and integrity of our data.
We work closely with security researchers to identify vulnerabilities in our application and infrastructure that attackers could exploit. All the vulnerabilities are resolved by our team.
We maintain security policies that cover the following key areas:
- Data classification
- Data retention and disposal
- Change management
- Information security
- Encryption and key management
- Security Incident Response
All Level employees and contractors receive formal security training as a part of their onboarding, which includes a review of all the Level policies.
Cloud access is managed using 2FA for accounts. The servers can only be accessed over the VPN. We maintain an extensive audit trail for all key operations.
Only a small number of engineers are permitted to have access to the backend database. This access is managed using IAM policies.
