Trust & Security
Leveled Meetings — built on a foundation of transparency, encryption, and accountability.
Hosted on AWS (US) · OAuth authentication · Stripe payments · TLS in transit; encrypted at rest.
The Short Version
Everything you need to know about how Leveled Meetings protects your data — at a glance.
🏠 Hosting
AWS, US region us-east-1
🔑 Identity
OAuth via Google / GitHub / GitLab — we never store or see your password
💳 Payments
Stripe Checkout — card data never touches our servers
🔒 Encryption
TLS in transit; encrypted at rest
🤖 Abuse Protection
Cloudflare Turnstile on signup, session creation, and checkout
📋 Accountability
Privileged and admin actions are audit-logged
Data We Store, and Where
What We Store
- Account profile from your OAuth provider (email, display name, avatar)
- Content you create in sessions — topics, contributions, comments, reactions, uploaded files
- Billing metadata — Stripe customer ID, credit balance, transaction history
What We Do Not Store
- Passwords
- Payment card numbers
Where It Lives
AWS us-east-1
- PostgreSQL (Amazon RDS) — application data
- Amazon S3 — uploaded files and exports
Data Residency
Served from the United States today. A Data Processing Agreement (DPA) is available on request.
If your organization requires data in a specific region, contact us — we can discuss a dedicated regional deployment.
Encryption — In Transit & At Rest
In Transit
TLS for all web traffic, terminated at Cloudflare. Real-time session traffic uses secure WebSockets (WSS).
RDS At Rest
The application database (Amazon RDS) is encrypted at rest.
S3 At Rest
File storage (Amazon S3) is encrypted at rest.
Secrets — SSM / KMS
Application secrets are stored in AWS SSM Parameter Store as KMS-encrypted SecureStrings. No secrets in source code or config files.
No secrets are ever committed to source code or configuration files. All sensitive values are managed through KMS-encrypted AWS SSM Parameter Store.
Authentication & Access Control
OAuth Sign-In Only
Google, GitHub, or GitLab. No password is created, stored, or transmitted to us. Sessions use short-lived signed tokens.
No Shared Admin Password
Administrators are granted via controlled database migrations and authenticate through the same OAuth flow as all users.
Session Access Modes
A session can be open (anyone with the code may join) or authenticated (only signed-in users may join) — the host chooses per session.
Domain-Restricted Sessions
For authenticated sessions, hosts can restrict joining to an allowlist of email domains — only accounts on those domains can get in.
Waiting Room
Hosts can enable a waiting room with hold rules per audience — anonymous joiners, other authenticated users, or accounts outside the allowed domain — and admit them manually.
Email Verification
Account emails are verified, with the verification token bound to the account it was issued for.
Privileged-Action Logging
Administrative actions — credit grants, role changes, support impersonation — are recorded in an append-only audit log. Impersonation uses short-lived, non-renewable, logged tokens.
Abuse & Bot Protection
Cloudflare Turnstile
Enforced server-side on the three flows most exposed to abuse:
- Anonymous join
- Session creation
- Checkout
Requests without a valid challenge token are rejected before they reach application logic.
Rate Limiting
Per-session and per-participant message rate limiting is in place to prevent flooding and abuse of real-time session infrastructure.
Turnstile challenges are validated server-side — client-side bypass attempts are ineffective.
Turnstile Challenge
Reject Invalid Tokens
Rate Limiting
Every sensitive flow is gated by a server-side challenge — ensuring bots and automated abuse are blocked before reaching Leveled Meetings application servers.
Payments
Card data is handled entirely by Stripe — it never reaches Leveled Meetings servers.
-
Stripe Checkout Hosted Surface
Users enter card details directly on Stripe's hosted checkout page — fully isolated from Leveled Meetings infrastructure.
-
Strong Customer Authentication
3-D Secure and SCA are handled entirely by Stripe, ensuring compliance with modern payment security standards.
-
What We Store
Only a Stripe customer reference and our own credit/transaction ledger. Never card numbers.
| We Store | Never Store |
|---|---|
| Stripe customer reference ID | Card numbers |
| Credit balance and transaction ledger | Payment card data of any kind |
Card numbers never touch Leveled Meetings servers — at any point in the payment flow.
Reliability & Data Lifecycle
Backups
Automated daily database backups with 7-day retention. Backups are managed through Amazon RDS automated backup infrastructure.
Deletion & Retention
Account deactivation and deletion are supported. Anonymous participant identities expire automatically — no manual cleanup required.
Day Backup Retention
Automated daily snapshots via Amazon RDS
Daily Backup Frequency
Consistent, automated, no manual intervention
Passwords Stored
OAuth-only — no password database to breach
Certifications & Roadmap
Leveled Meetings is not SOC 2 certified today. We build on infrastructure that is independently audited, and we inherit their physical, platform, and payment-security controls.
Our infrastructure partners maintain the following certifications:
| Provider | Certifications | Scope |
|---|---|---|
| Amazon Web Services | SOC 2, ISO 27001 | Hosting, database, file storage |
| Cloudflare | SOC 2, ISO 27001 | Edge network, TLS, bot protection |
| Stripe | SOC 2, ISO 27001, PCI DSS Level 1 | Payment processing |
By building on these platforms, Leveled Meetings inherits their rigorous physical, platform, and payment-security controls — without needing to independently replicate them.
Sub-Processors
The following third-party sub-processors handle data on behalf of Leveled Meetings:
| Sub-Processor | Role | Handles |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, transactional email (SES) | All application data, uploaded files, outbound email |
| Cloudflare | Edge network, TLS termination, bot protection (Turnstile) | Request metadata, IP addresses |
| Stripe | Payment processing | Billing identity, payment card data (entered directly with Stripe) |
| Google / GitHub / GitLab | Identity (OAuth sign-in) | Authentication; email and profile shared at sign-in |
Working With Your Security Team
We're built to work directly with your security reviewers. Here's what we can offer:
Vendor Security Questionnaires
We will complete reasonable vendor security questionnaires on request.
Data Processing Agreement (DPA)
A DPA is available on request for organizations that require formal data processing documentation.
Regional Data Residency
Region-specific data residency can be discussed — we support dedicated regional deployments for organizations with specific requirements.
Responsible Disclosure
Report suspected security issues to support@leveledmeetings.com.
Security contact: support@leveledmeetings.com — reach out for questionnaires, DPAs, regional deployments, or responsible disclosure.