Security at Leavely

01Encryption

All traffic to Leavely is encrypted in transit with TLS. Data at rest, including your database records and file uploads, is encrypted by our infrastructure providers.

In plain terms: Your data is scrambled both on the way to us and while it sits in storage.

02Access control

Every request is scoped to your company, so one tenant can never see another's data. Within the product, roles determine what each person can do. Administrative access to production is restricted to the people who need it and is logged.

In plain terms: Companies are walled off from each other, and only a few of us can touch production, always on the record.

03Authentication

Passwords are stored hashed, never in plain text. Email verification protects new accounts, sign-in attempts are rate limited and screened for credential stuffing, and sessions expire so a forgotten login doesn't stay open forever.

04Infrastructure

We build on established cloud providers for hosting and the database rather than running our own servers. This gives us their physical security, patching, and redundancy by default.

05Monitoring

We monitor errors continuously so problems surface quickly. When a fault is recorded, text and form inputs are masked before the report leaves your browser.

06Reporting an issue

Found a vulnerability? We want to hear from you. Email support@leavely.co and we will respond promptly. We appreciate responsible disclosure.

In plain terms: Spot a security problem? Tell us and we'll act fast.