An agent that can send email, fill forms and pay for things has to be built so that a mistake, a bad instruction or a leaked database row cannot turn into harm. This page explains how LVLZ is built to keep you safe.
Approvals the model cannot skip
Some actions always need a human yes: paying for something, writing to a person for the first time, deleting data and inviting someone to your workspace. These approvals are enforced in the code that runs each operation, before it runs, and not by asking the model to behave. A prompt injection on a web page cannot talk its way past them. You choose which rules are on in your approval settings.
Secrets are sealed
- Passwords, payment cards, addresses and the tokens for your connected services are encrypted at rest with AES-256-GCM.
- Each workspace or user has its own encryption key, derived from a master secret that never leaves the server environment, so a single leaked row cannot be opened with another owner’s key.
- When a browser task needs a password or a card, the server-side browser fills it in directly. The AI model sees that a field was filled, never the value itself.
Access to your account
- You sign in with a one-time code sent to your phone, by email or with Google. Verification codes are stored only as keyed hashes.
- Access tokens are random and stored only as hashes.
- In the app you can see your signed-in sessions.
- Workspace data is protected by row-level security in the database, so every read is checked against the signed-in user.
Where your data lives
LVLZ runs on established infrastructure providers:
- Vercel hosts the website, the app and the agent, and runs browser tasks in isolated sandboxes.
- Supabase stores workspace data in Postgres with row-level security.
- OpenRouter routes requests to the AI model you choose for each kind of task.
- Linq delivers iMessage conversations.
- Google is used only when you connect your Google account, with the permissions you grant.
- Polar processes subscription payments. LVLZ never stores your card details for billing.
See the privacy policy for what we collect and why.
Your control over memory
You can see, edit, delete and export everything your agent remembers in the memory center at app.lvlz.ai.
Reporting a vulnerability
If you believe you have found a security issue, please email security@lvlz.ai with the details and steps to reproduce. We will acknowledge your report, keep you updated and credit you if you wish. Please do not access other people’s data or disrupt the service while testing.