Security at Levels Flow

Levels Flow uses Supabase Auth to manage sign-in and sessions. Application permission checks and database row-level security policies restrict access to records according to the signed-in user and their workspace or project permissions.

Protect your account with a unique password, keep access to your email secure, and review who you invite into your studio or projects. An invitation or shared link grants access to another person, so choose recipients carefully.

Audio and other files are stored using Cloudflare R2 and Supabase Storage. The application checks access before issuing signed file URLs. Where payment gating applies, the playback and download flow checks the linked payment status before granting access to gated files.

Signed file URLs expire, but they act as access credentials while valid. Share links and signed storage URLs are different: revoking a share link does not necessarily invalidate a storage URL already issued. Neither revocation nor payment gating can recall a file someone has already downloaded.

Available controls include password-protected share links, link expiry on eligible plans, and watermarked previews on eligible plans. Use the controls that suit the sensitivity of your work and remove access when it is no longer needed.

A password or watermark can reduce unintended sharing; it cannot prevent every form of copying or recording. Share passwords separately from links and avoid posting private links in public channels.

Levels Flow uses Supabase for authentication and database services, Vercel for application hosting, and Cloudflare R2 for file storage. Public service connections use HTTPS. Signed file delivery and access checks help control who can retrieve files.

See the Privacy Policy for information about providers, processing locations, personal information and overseas disclosures. Provider security controls do not guarantee that any online service is immune to incidents.

Error and performance monitoring helps identify faults when configured. Optional product analytics is subject to the cookie choice described in our Privacy Policy. Monitoring data can contain technical identifiers; we do not describe it as universally anonymous.

Your content remains yours. We do not sell personal information or use your content to train machine-learning models. The Terms of Service explain the limited permission needed to host, process and deliver your content.

You can download files you have permission to access and request an account-data export. The account export contains supported records rather than a complete bundle of audio and other files, and large exports may have limits. Contact us if you need help obtaining a complete copy of your information.

Account deletion starts removal of associated records and files. Background processing, audit records and provider backups mean every copy is not necessarily removed immediately. See the retention section of our Privacy Policy.

Keep independent copies of important recordings and documents. Storage durability is not the same as a backup or a promise to restore a particular deleted file.

Levels Flow has not completed an independent SOC 2 or ISO 27001 audit. A service provider’s certification does not certify Levels Flow itself.

If your organisation needs a security questionnaire, audit report, specific retention commitment or contractual assurance, contact admin@levelsflow.com before relying on the Service for that requirement.

Send suspected vulnerabilities to admin@levelsflow.com. Include the affected page or feature, what you observed, approximate time, and steps to reproduce using your own account and test data.

Do not include passwords, authentication tokens, payment details or another person’s private files. Redact sensitive information from screenshots. Avoid testing that accesses other users’ information, interrupts the service or damages data; ask us before undertaking testing beyond your own authorised access.

We welcome coordinated reporting and will assess the report and follow up where contact details are provided. This page does not promise a response time, bounty or permission for unauthorised testing.