> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lvlz.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> How LVLZ protects your account, your vault and your connected services.

An agent that can send messages, fill forms and pay for things has to be built so that a mistake, a bad instruction or a leaked database row can't turn into harm.

## Approvals the model can't skip

Paying for something, writing to someone new, deleting data, inviting someone and setting up anything that keeps running on its own always need your yes. These checks run in LVLZ's code before each action, not by asking the AI to behave, so a prompt hidden in a web page or a file can't talk its way past them. See [Approvals and undo](https://docs.lvlz.ai/agent/approvals-and-undo.md).

Instructions that arrive from outside, like text in a forwarded message or a page your agent reads, are treated as information, not as orders from you.

## Secrets are sealed

* Passwords, payment cards, addresses and the keys for your connected services are encrypted at rest with AES-256-GCM.
* Each workspace or user has its own encryption key, so one leaked row can't be opened with another owner's key.
* When a browser task needs a password or a card, the browser on the server fills it in. The AI model sees that a field was filled, never the value.
* Keys for tools and payment providers are entered on one-time secure pages, never in the chat.

## Your account

* You sign in with a code bound to your own phone number. Codes and access tokens are stored only as hashes.
* See and sign out of your sessions in the web app under **Settings**.
* Every read of workspace data is checked against the signed-in user. Your browser can't write to the database directly; every change goes through LVLZ's server, which checks who you are and what you may do.

## Your data

* See, edit, delete and export what your agent remembers in the [memory center](https://docs.lvlz.ai/agent/memory.md).
* Your agent talks only with you and your workspace members, and never messages your clients on its own.
* LVLZ measures its own ads with Meta's pixel on lvlz.ai and the web app's sign-in screen, and tells Meta when an account signs up, starts its trial or subscribes. Meta gets your phone number and account id only as one-way hashes, and never your messages, workspace or files. Your clients' pages (bookings, landing pages, links, contact and chat pages) are never measured. In the EU, the UK and Switzerland nothing runs until you agree; anywhere, **Cookie settings** at the bottom of lvlz.ai changes your choice.
* Read the [privacy policy](https://lvlz.ai/privacy) and [security page](https://lvlz.ai/security) for more.

## Report a vulnerability

Email [support@lvlz.ai](mailto:support@lvlz.ai) with the details and steps to reproduce. We'll acknowledge your report, keep you updated and credit you if you wish. Please don't access other people's data or disrupt the service while testing.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.