How we protect your data.

Your data sits in a managed PostgreSQL database powered by Supabase, hosted on enterprise infrastructure in the United States. The application runs on Vercel — same platform GitHub, Stripe, and The Washington Post use. Your data never lives on a laptop, a thumb drive, or a shared spreadsheet.

• TLS 1.2+ in transit. All connections between your browser and our servers are encrypted. HSTS enforced — connections can never be downgraded.
• AES-256 at rest. Data stored in our managed database and file storage is encrypted at rest by our infrastructure providers (Supabase and AWS) using AES-256.
• Access-gated sensitive fields. Compensation and other sensitive HR fields are restricted to explicitly authorized roles, and every access is written to the audit trail. We don't collect Social Security numbers today; application-level field encryption is on our roadmap for any high-sensitivity fields we add.

• Per-tenant scoping on every request. Each request resolves the acting organization, and every read and write is filtered to that account boundary across the application and API layer.
• Least-privilege access within a tenant. Beyond the tenant boundary, a granular role system (below) governs who can see what, and access to sensitive fields is permission-gated and logged.
• Defense in depth. Tenant scoping is backed by role checks, parameterized queries, and audit logging, and cross-tenant access is covered by our automated test and review process.

• Email and password. 8+ characters, mixed case, numbers. Hashed with bcrypt (12 salt rounds). Never stored in plain text.
• Google SSO. OAuth 2.0 for streamlined corporate access.
• Magic-link sign-in. Passwordless via email with one-time tokens that expire in 5 minutes.
• Two-factor authentication. Authenticator-app (TOTP) two-factor authentication with backup codes is available on every account, alongside Google SSO and passwordless magic-link sign-in. Workspace-wide enforcement is opt-in for administrators.
• Account lockout. Auto-lock after repeated failed login attempts (30-minute cooldown).
• Session management. HTTP-only, secure cookies with SameSite=strict. Users can view and revoke active sessions per device.

Access to data is governed by a granular role system. Sensitive fields (compensation and other restricted HR data) are only visible to roles explicitly granted access, and every access is logged.

• XSS. Content Security Policy with nonce-based script validation. All user input sanitized.
• CSRF. Per-request tokens with constant-time comparison.
• SQL injection. Parameterized queries throughout. SQL identifier validation and sanitization on all inputs.
• Clickjacking. X-Frame-Options DENY; frame-ancestors CSP directive blocks embedding.
• Rate limiting. Redis-backed rate limiting on all API endpoints to prevent abuse and brute-force attacks.
• CORS whitelist. Only authorized origins can make API requests. Webhook signatures cryptographically verified.

• Access to compensation and other sensitive HR fields is restricted to explicitly authorized roles.
• Every access to sensitive data is logged with who, when, and from where.
• Document access levels (public, employee-only, manager-only, HR-only, payroll-only) control who sees what.
• Profile privacy controls let employees manage the visibility of their personal info.
• We minimize collection of high-risk identifiers — we do not store Social Security numbers today.

• Automated daily database backups, managed and encrypted at rest by our infrastructure provider (Supabase).
• Point-in-time recovery is available on our managed database platform and is being enabled as we scale.
• A written disaster-recovery and incident-response runbook governs restores and customer notification.

• Real-time error tracking via Sentry with PII filtering.
• Security event logging — login attempts, access grants, role changes, sensitive data access — with timestamps, IPs, and user agents.
• CSP violation reporting to our monitoring endpoint.
• Confirmed incidents investigated, contained, and customers notified within 72 hours with a post-incident report.
• Passwords, tokens, and secrets stripped from all log output.

Built on enterprise-grade cloud services with independent security certifications.

• Use a strong, unique password (8+ chars with uppercase, lowercase, numbers), or sign in with Google SSO or a magic link.
• Never share your login credentials.
• Log out from shared or public computers after use.
• Review your organization's user list regularly and remove access for departing employees promptly.
• Report suspicious activity to security@lvlupperformance.com immediately.

If you discover a security vulnerability, please report it before disclosing it publicly. Email security@lvlupperformance.com with a description, steps to reproduce, and the potential impact. We acknowledge within 48 hours and aim to provide an initial assessment within 5 business days.