Security, privacy and governance
Last updated: 1 September 2026
Security, privacy and governance are fundamental to how Laveeka operates. This page sets out the controls in place, the independent assessments they are subject to and the current status of each programme. It is maintained as a factual record, distinguishes what is in place from what remains in progress, and is updated as each programme advances.
1. Where we are today
Our controls are subject to independent assessment. Oneleet, a security and compliance firm, was engaged on 26 August 2026 to run our SOC 2 Type 2 programme and to conduct annual penetration testing of our application. Our ISO/IEC 27001 programme is also run with Oneleet and is now underway.
| What | Status |
|---|---|
| SOC 2 Type 2 Assessment of security controls against the AICPA Trust Services Criteria |
Programme underway. Started 26 August 2026 with a three month observation period. A Type 2 report describes how controls actually operated across that window, not how they looked on one day, which is why it cannot be rushed. We are not SOC 2 certified yet and will not say we are until the report is issued. |
| Penetration testing Independent testing of the application |
Annual, by Oneleet. A senior tester works through functionality, business logic and vulnerabilities, covering the OWASP Top 10 and testing against the OWASP Application Security Verification Standard and Web Security Testing Guide. |
| ISO/IEC 27001 Information security management |
Programme underway. Also with Oneleet, running alongside the SOC 2 work, which covers much of the same control ground. Certification is granted by an accredited certification body following audit, so as with SOC 2 we will not describe ourselves as certified until that is complete. |
| Privacy and GDPR Australian Privacy Act and, where it applies, the GDPR |
Operating. Our Privacy Policy and sub-processor list are published, not held back for a questionnaire. |
The Oneleet engagement letter is available on request if your procurement or security team needs evidence for a file: hello@laveeka.com.
2. How the systems are built
Most data incidents are not sophisticated attacks. They are ordinary mistakes that a permissive system allowed to happen. The controls we place the most weight on are therefore the ones the database enforces, rather than those that depend on a person remembering.
- Every table is protected at the row. Access is decided by the database on each query against the signed-in user and their role, not by the application asking nicely. A bug in an interface cannot widen what a person can reach.
- Least privilege by default. Roles are owner, member and read-only. A read-only account cannot write, and the database is what refuses, not the screen.
- Credentials never reach the browser and never reach our code repository. Keys and tokens live in the platform's secret store. Anything that needs one runs server side and hands back only the answer.
- An immutable audit log. Every insert, update and delete is written with the actor, the time and what changed. It can be read and it cannot be edited.
- Recording is a decision, not a default. Meeting capture is started deliberately and can be declined. Section 6 of the Privacy Policy sets out how.
- Content is never used to train models. Transcripts and summaries are processed to return a result to us and for nothing else.
3. Where information is held
Our platform database is hosted with Supabase and currently sits in an Asia Pacific region outside Australia. A move to Sydney is planned and this page will be updated when it is complete. Overseas hosting is permitted under Australian Privacy Principle 8 provided we remain accountable for how the information is handled, and we do. The sub-processor list names every provider we rely on, what it handles and which country it operates in. It is published so a client's privacy team can see the full picture without having to ask for it.
4. The experience behind it
This is not our first time through a data governance programme. Our co-founder was the operational lead for GDPR implementation at a New York Stock Exchange listed business when the legislation came into force in 2018, running the control work across a large, regulated, people-intensive organisation.
That experience informs how we work. Controls that people route around are worse than no controls, because they deliver the appearance of compliance without the substance. We would rather build the system so that the compliant path is also the easiest one.
5. Reporting a problem
If you believe you have found a vulnerability in anything we run, tell us at hello@laveeka.com and we will come back to you. Please give us a reasonable window to fix it before publishing anything, and please do not access, change or keep data that is not yours while testing.
If you are a client and you think information may have been exposed, say so in the subject line and we will treat it as an incident from the moment it arrives.