# Compliance

> SOC 2 Type II, penetration testing, and privacy regulations.

Source: https://www.lev.com/docs/learn/compliance

Last updated: December 2025

---
SOC 2 is the gold standard for demonstrating that a SaaS company has rigorous
      security practices. Developed by the American Institute of CPAs, it requires companies
      to prove they've implemented specific controls across security, availability,
      processing integrity, confidentiality, and privacy.
    
    
      But there's an important distinction most people miss:{' '}
      **Type I vs. Type II**. A Type I
      audit is a snapshot—it verifies that controls exist at a specific moment. Type II is
      far more rigorous. An independent auditor examines our systems over a 6-12 month
      period, verifying that security controls don't just exist on paper, but are
      consistently followed in practice.
    
    
      When you see that we're SOC 2 Type II certified, it means a CPA firm has verified
      that month after month, our security practices actually work. It's the difference
      between claiming you lock your doors and proving you've locked them every single night.
    
  

  **Overview**

- **audit_type:** Type II (Operating Effectiveness)
- **frequency:** Annual
- **auditor:** Independent third-party CPA firm
- **standard:** AICPA Trust Services Criteria

  Trust Service Criteria
  
    Our SOC 2 report covers three of the five Trust Service Criteria—the ones most
    relevant to protecting your deal data:
  
  

  
    
      
        access
        Access controls & identity management
      
      
        encryption
        Data encryption at rest & in transit
      
      
        continuity
        Business continuity planning
      
      
        incident
        Incident response procedures
      
      
        change_mgmt
        Change management processes
      
      
        vendor_risk
        Vendor risk management
      
    
  

  

  

  
    
      Penetration testing is essentially hiring professional hackers to try to break into
      your systems before the bad actors do. Most companies do this annually—check a box,
      file the report, move on for another year. We think that's dangerously inadequate.
    
    
      **We test quarterly.** Every
      three months, an independent security firm attempts to compromise our infrastructure,
      applications, and APIs using the same techniques real attackers would use. When they
      find vulnerabilities—and good testers always find something—we fix them immediately,
      not eleven months later.
    
    
      The cybersecurity landscape changes constantly. New vulnerabilities are discovered
      weekly. Annual testing means your security posture is only verified once, then
      potentially drifts for months. Quarterly testing means we catch issues while they're
      fresh and remediate before they become exploitable problems.
    
  

  
    
      
        vendor
        Penti (Certypie Inc)
      
      
        frequency
        Quarterly + continuous scanning
      
      
        methodology
        OWASP (web apps), PTES (infrastructure)
      
      
        scope
        Production, staging, QA environments
      
    
  

  
    
      
        network
        External network infrastructure
      
      
        web_apps
        Web applications (OWASP methodology)
      
      
        api
        API endpoints
      
      
        auth
        Authentication systems
      
    
  

  
    
      
        
          
          
          
        
        pentest-results.sh
      
      
        
          $ penti scan --env production --quarter Q2-2025
        
        
          
            
            Scan complete. No critical vulnerabilities found.
          
        
        
          
            0
            critical
          
          
            0
            high
          
        
        
          
            $ penti list --verified
          
          
            ✓ XSS  ✓ SQLi  ✓ IDOR  ✓ SSRF  ✓ SSTI  ✓ XXE  ✓ LFI  ✓ Redirect  ✓ DepConf  ✓ Crypto
          
        
      
    
  

  
    
      
        ✓ xss
        Cross-site scripting vulnerabilities
      
      
        ✓ sqli
        SQL injection attacks
      
      
        ✓ idor
        Insecure direct object references
      
      
        ✓ ssrf
        Server-side request forgery
      
      
        ✓ ssti
        Server-side template injection
      
      
        ✓ xxe
        XML external entity processing
      
      
        ✓ lfi
        Local file inclusion
      
      
        ✓ redirect
        Open redirect vulnerabilities
      
      
        ✓ dep_conf
        Dependency confusion attacks
      
      
        ✓ crypto
        Cryptographic implementation flaws
      
    
  

  Remediation Timeline
  
    Finding vulnerabilities is the point—it means the testing is working. What matters
    is what happens next. Every finding is triaged immediately based on severity:
  
  

  

  

  
    
      Privacy regulations exist because people deserve control over their personal data.
      We built Lev with this principle at its core—not because regulators required it,
      but because we believe it's the right way to handle sensitive information.
    
    
      Our platform processes deal data, lender communications, and professional relationships.
      This is information you've spent years cultivating, and it should remain under your
      control. Privacy compliance isn't just about checking regulatory boxes—it's about
      honoring the trust you place in us.