Security + Trust

Every control we run, in plain English. We'd rather under-promise than oversell — anything below labelled "in progress" or "planned" is honestly disclosed; if you need certainty before a contract, reach out at security@levelchat.io.

Read the DPA Status page →Disclose a vulnerability

Controls

The technical + organisational measures (TOMs) we run today. Each row maps to a corresponding clause in our DPA.

Encryption in transit

TLS 1.3 + DTLS-SRTP

Every client-to-edge connection uses TLS 1.3 with HSTS preloaded. Media between participants is DTLS-SRTP — perfect forward secrecy, encrypted-by-default, never plaintext on the wire.

Encryption at rest

AES-256-GCM

Recordings, transcripts, and chat history sit on AES-256-GCM volumes. Customer-managed KMS available on Enterprise (BYOK).

End-to-end encryption

Insertable Streams

Optional per-room E2EE via the SDK insertable-streams pipeline. Media frames are encrypted in the publisher and only decrypted on subscribers — the SFU never sees the plaintext frame body.

Identity + authentication

OIDC SSO + SCIM 2.0

OIDC SSO on Business + Enterprise tiers (Okta, Microsoft Entra, Google Workspace and any RFC-8252-compliant IdP), with PKCE + nonce + JIT user provisioning. SCIM 2.0 user + group sync endpoints, conformance-tested against the RFC-7644 protocol surface. SAML 2.0 is on the roadmap.

Authorisation

Role-based access

host / co-host / member / viewer roles enforced server-side. JWT tokens are short-lived (≤ 1 hour) + refreshable. mTLS between every internal service.

Audit log

90-day retention by default

Every privileged action (admit, kick, recording start, settings change) writes an immutable audit row. Enterprise contracts get 1-year retention + SIEM stream-out (Splunk, Datadog, Elastic).

Rate limiting

Per-org + per-IP

API + signalling traffic is rate-limited at the gateway. Abusive callers get exponential back-off + 429 — no flooding the SFU.

Vulnerability management

Auto-patch + scan

Every dependency PR runs npm audit / pip-audit / cargo audit / govulncheck. Container images are rebuilt nightly from the latest patched base image; signed with cosign before publish.

Backup + recovery

Daily encrypted snapshots

Postgres + recording storage snapshotted daily; encrypted; off-region replicated. RPO ≤ 24h, RTO ≤ 4h on managed cloud. Self-host operators configure their own retention.

Data residency

EU by default

Default region is EU (Frankfurt + Helsinki on Hetzner). Other regions selectable per-room. Cross-region transfers are governed by the SCCs incorporated in our DPA.

Certifications + frameworks

What we've formally certified to + what's on the calendar. We're transparent about in-progress work because lying about it would just delay a customer's procurement step.

Framework	Status	Detail
GDPR (EU 2016/679)	Live	DPA available via /legal/dpa with EU SCCs (2021/914) incorporated. Default EU residency, named DPO.
SOC 2 Type II	In progress	Type I report completed Q1 2026; auditor engagement for Type II underway, expected Q4 2026. Readiness packet available under NDA.
HIPAA BAA	Live	BAA signed on Scale + Enterprise tiers. PHI is never logged; recordings on customer-managed KMS on Enterprise.
ISO 27001	Planned	On the 2027 roadmap; controls are aligned to ISO 27001:2022 today.
KVKK (Turkish DPA)	Live	KVKK addendum available for Turkish customers, mirroring our GDPR posture. See /legal/kvkk.

Vulnerability disclosure

We treat security reports as a partnership. Email security@levelchat.io with a clear reproducer; we acknowledge within 24 hours, fix critical issues within 7 days, and credit researchers (with permission) on our security advisories page once a CVE lands.

Safe-harbour: good-faith research that respects user privacy and follows our scope (live LevelChat domains, not customer data) will not face legal action from us.