Security & compliance

We sign the right agreement before any data is shared.

• Business Associate Agreements (BAAs) for work involving protected health information
• FERPA-compliant data agreements for schools and districts
• NDAs and data-sharing agreements for nonprofits and partners

We carry errors & omissions (E&O) insurance. Certificates of insurance are available on request.

We work to the principle of least access: only the people and systems that need your data can reach it. These practices are written into our agreement with each client.

• Your data stays in your environment wherever possible
• Encryption in transit and at rest
• Access granted per project and reviewed regularly
• De-identified or synthetic data for development and testing
• Access removed and data returned or deleted when a project ends, as our agreement specifies

We build to the rules your organization works under.

• HIPAA Privacy and Security Rules
• FERPA
• WCAG 2.1 AA accessibility

If we discover a security incident affecting your data, we notify you promptly, within the timeframes your agreements and the law require, and work with your team on the response.

We answer vendor security questionnaires and join security reviews as part of procurement. Send them to security@levralabs.com.