Security

Effective Date: 10 September 2026

JSMN EQT LLC, doing business as levelpartner.ai, operates the security measures described below. Christian Olsson is the individual responsible for information security.

Access control. All staff use company-controlled levelpartner.ai accounts. Two-factor authentication is enforced on all staff accounts. Credentials are managed through a company password manager. Access is granted on a least-privilege basis and removed when a person's role ends.

Client data separation. Each client's data is held in its own separate sub-account. Access is limited to the sub-account a person is authorised to work in, so one client's data is not reachable from another's.

Device security. All staff devices use full-disk encryption.

Data in transit. Connections to our website and client platforms are encrypted using TLS.

Payment data. Card payments are processed by Stripe. We do not store full card numbers.

Incident response. We operate a documented incident response plan with a named responsible individual, an incident log covering every incident we assess whether or not it is reportable, and at least one test each year. Where we process personal data on a client's behalf and a personal data breach affects that client's data, we notify the client in writing within 24 hours of becoming aware of it.

Documentation for clients. Our information security programme and incident response plan, our records of processing activities, our data protection impact assessment and our vendor transfer register are available to clients on request through privacy@levelpartner.ai. Our data processing agreement can be signed by both parties at levelpartner.ai/dpa.

Sub-processors and transfers. We use third-party processors to deliver our services. The authoritative list, with a version date and their own sub-processors, is published at levelpartner.ai/sub-processors.

Where personal data is transferred outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, on the EU-US Data Privacy Framework and its Swiss-US and UK Extensions where the recipient is certified under them, and on the UK International Data Transfer Addendum where UK law applies.

Two-factor authentication for client accounts

Two-factor authentication is available to every user and can be enabled at profile level:

1. Log in to the account.
2. Go to Settings.
3. Open My Profile.
4. Find Two-Factor Authentication (2FA).
5. Click Setup.
6. Open Google Authenticator, Microsoft Authenticator, Authy, or another TOTP authenticator app.
7. Scan the QR code shown on your screen.
8. Enter the 6-digit code generated by the authenticator app.
9. Click Next or Confirm to activate 2FA.
10. Save the 10 backup codes somewhere secure.
11. Log out and log back in to verify that 2FA is working.

Reporting a security concern

If you believe you have found a security issue, email privacy@levelpartner.ai and we will respond.

Last updated: 10 September 2026