Security Overview

Every piece of data in LevelSixLabs is scoped to an organisation. Database Row-Level Security (RLS) policies are enforced at the database level — not just in application code — ensuring that one organisation cannot access another's data, even in the event of an application bug.

Organisation isolation is enforced by a SQL helper function (auth_organisation_id()) that verifies the caller's identity on every query.

LevelSixLabs implements a four-tier role hierarchy:

Permissions can be further customised per user at a module and action level (view / create / edit / delete / verify / manage). Training-gated equipment bookings enforce additional safeguards.

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 by Supabase (PostgreSQL on AWS RDS)
• Uploaded files (SDS documents, service certificates) are stored in private Supabase Storage buckets with per-organisation access controls
• Files are served via short-lived signed URLs (1-hour expiry) — never via public URLs
• Authentication tokens are httpOnly, Secure cookies managed by Supabase Auth

• Email/password authentication with Supabase Auth
• Google and Microsoft OAuth SSO available
• Sessions are automatically refreshed and expired by Supabase
• Password reset via email with time-limited secure tokens
• Email invitations with single-use links

• Uploads are restricted to specific MIME types per feature (PDF, JPEG, PNG, WEBP, XLSX)
• File size limits enforced (25 MB for service records, varies by feature)
• Files are stored in private buckets — not accessible without authentication
• Storage paths include organisation ID to enforce org-level isolation

• Content-Security-Policy (CSP) — restricts resource loading to trusted origins
• X-Frame-Options: SAMEORIGIN — prevents clickjacking
• X-Content-Type-Options: nosniff — prevents MIME-sniffing attacks
• Strict-Transport-Security (HSTS) — enforces HTTPS for 2 years
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy — disables access to camera, microphone, geolocation at the browser level

In the event of a data breach affecting personal data, we will notify affected customers and, where required by UK GDPR, the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.

• UK GDPR compliant data handling and processing
• Data stored in EU West (London) region by default
• Data Processing Agreement (DPA) available on request
• Annual security review planned

To request a Data Processing Agreement, contact privacy@levelsixlabs.com.

Security documentation for each provider is available on their respective trust pages.