Secured & Verified By
Every layer of LEVE is protected by trusted, independently audited providers.
How We Protect Your Data
Encryption
TLS 1.2+ encryption on all connections with HSTS preload enabled
Database encrypted at rest with AES-256 via Supabase
Stripe handles all card data — we never see or store payment credentials
Identity documents processed by Veriff — never stored on our servers
Authentication & Access Control
Role-based access control: super admin, admin, manager, VA, member, contractor
KYC identity verification required for all client organization administrators
Server-side session validation on every request with CSRF protection
Email-based login verification with OTP and trusted device management
Automatic session timeout after period of inactivity
Infrastructure
Hosted on Vercel's edge network with automatic SSL certificate management
DDoS protection and global CDN at the infrastructure level
Content Security Policy (CSP) headers on all routes
X-Frame-Options DENY prevents clickjacking attacks
Strict-Transport-Security with preload ensures HTTPS-only access
Adaptive rate limiting via Arcjet protects against brute force and abuse
Application Security
Parameterized database queries prevent SQL injection across all operations
63 foreign key constraints enforce referential integrity at the database level
Auth checks on every server action with organization-scoped data access
Multi-tenant architecture with strict data isolation between organizations
Webhook signatures verified for all external integrations (Stripe, Veriff)
Complete audit trail — every data change is logged with actor, timestamp, and details
Privacy & Data Handling
No third-party advertising or data selling — your data is yours
Minimal data collection — we only store what's necessary for HR operations
Sensitive documents (IDs, contracts) stored in encrypted Supabase Storage with signed URLs
Self-service token system for contractor data collection — no login required, single-use links
Continuous Security Monitoring
Automated scanning runs on every code change and on a weekly schedule.
SSnyk
Dependency vulnerability scanning on every push and PR. High-severity issues flagged automatically.
CCodeQL
GitHub's static analysis engine scans for SQL injection, XSS, and other code-level vulnerabilities.
DDependabot
Automatic weekly dependency updates with vulnerability alerts and auto-fix PRs from GitHub.
Apnpm Audit
Built-in package manager audit runs on every build to catch known vulnerabilities in the supply chain.
Independent Verification
You can independently verify our security posture using these free tools:
Questions about security?
If you have security concerns or want to report a vulnerability, please reach out to our team.
admin@remoteleverage.com