Trust & Security
How we protect your data
This page is maintained by the Level Set team to answer common security and privacy questions. It describes practices in place today and is not an independent certification.
Authentication
Access requires email + password or a supported OAuth provider. New accounts require administrator approval before any data is accessible. Leaked-password detection is enabled — passwords found in public breach corpora are rejected on sign-up and change. Anonymous sign-in is disabled.
Access control
Every table enforces row-level security. Content and reporting data is scoped to the requester's agency; administrator functions require an explicit role check. Storage buckets serve module assets only to agency members assigned to that module.
Audit logging
Administrator actions and role changes are recorded in an append-only audit log. Records cannot be modified or deleted after they are written, even by the account that created them.
Transport & headers
All traffic is served over TLS with HSTS preload. Responses set hardening headers — frame denial (X-Frame-Options), MIME-sniffing protection, a restrictive referrer policy, a locked-down permissions policy, and cross-origin isolation — to reduce browser-side attack surface. A formal Content-Security-Policy header is not yet configured.
Hosting & platform
The application runs on Lovable's managed infrastructure. This is not a StateRAMP-Authorized environment today; customers requiring formal ATO should contact us to discuss deployment options.
Reporting a vulnerability
Please email help@happypeoplegames.com with details and reproduction steps. Machine-readable contact information is published at /.well-known/security.txt.