Security

Where your data is held, who can reach it, and which parts we deliberately hand to specialists.

Where your data lives

Levry runs on managed infrastructure in the European Union. Application servers and the primary database are hosted in the EU region, so portfolio, booking and tenant data stays within the EEA in normal operation.

A small number of service providers outside the EEA are used for specific functions — email delivery and the AI assistant on our website. These are listed in our privacy policy, along with the safeguards that apply.

Data in transit

Every connection to Levry is served over HTTPS. Traffic between your browser and the platform is encrypted in transit, and the site is served over HTTP/2.

Who can get in

Access to Levry's internal tooling is restricted to named accounts on our own domains, authenticated through Google Workspace single sign-on. We hold no passwords for it: authentication is delegated to Google, so whatever multi-factor requirement our Workspace enforces applies to the platform too.

  • Sign-in is restricted by email domain, checked on the server for every request rather than only at login.
  • Sessions expire after seven days, so access has to be re-established through Google rather than persisting indefinitely.
  • The application programming interfaces are protected by the same check as the pages behind them, not just the user interface.
  • Machine access for scheduled jobs uses a separate shared secret, and grants nothing if that secret is unset.

Payments and signatures

Card details never reach Levry. Payments are handled by Stripe, a PCI DSS Level 1 service provider, and are collected on Stripe's own hosted pages. Levry stores a reference to the transaction, not the payment instrument.

Contracts are signed and stored through DocuSign, so signature integrity and the audit trail are handled by a specialist rather than reimplemented by us.

Where Stripe notifies us of a payment event, the message is verified cryptographically before it is accepted, so a forged notification cannot alter a payment record.

What we don't collect

Our public website sets no cookies, and carries no analytics, advertising or tracking technology. We do not profile visitors, and we run no automated decision-making about individuals.

Credentials and configuration

Secrets — database credentials, API keys, signing secrets — are held as environment configuration in the hosting platform, separate from the application code, and are not stored in our source repository.

Working with your procurement team

If your procurement or IT security process needs a security questionnaire completed, a data processing agreement in place, or detail on our hosting, access control and recovery arrangements, contact us and we will work through it with you directly.

Reporting a vulnerability

If you believe you have found a security issue in Levry, please email security@levry.com with enough detail to reproduce it. We will acknowledge your report and keep you updated while we investigate. Please give us a reasonable opportunity to fix an issue before disclosing it publicly.