Authorised access
Teacher and learner application areas require authenticated access. Server routes verify the signed-in account and the teacher-student relationship before returning private records.
Security
Learner evidence is private by default.
Last updated: 2026-10-10. This page describes the security controls Levaloop currently uses and the boundaries we deliberately keep around teacher and learner data.
How Levaloop protects private data
Database boundaries
Private tables use row-level security or server-only access patterns. Browser clients are not given unrestricted database access to teacher, learner, recording or AI-conversation data.
Private media storage
Lesson recordings and student photos are stored in private storage buckets. They are not published through permanent public URLs; authorised workflows use controlled or short-lived access.
Server-side secrets
Service credentials and AI provider keys are kept in server-side environment variables rather than public browser configuration.
Student sign-in protection
Student code and PIN login attempts are rate-limited using privacy-minimised identifiers, reducing repeated guessing without storing the attempted credentials as plain tracking data.
Human approval
AI can help interpret lesson evidence, but teacher review remains part of the workflow before learner-facing review content is approved or shared.
What we do not promise
No system is perfectly secure
Levaloop uses layered controls to reduce risk, but no online service can honestly guarantee that a security incident will never happen.
Security claims follow the product
We describe controls that exist in the product today. We do not claim certifications, audits or compliance badges that have not actually been obtained.
Report a security concern
Responsible reporting
If you believe you have found a vulnerability or exposed private data, contact us at support@levaloop.co. Please include enough detail for us to reproduce the issue and avoid accessing or sharing data that is not necessary to demonstrate it.