Trust center
Security and data protection
ProLevelUp is a product of Galaxian Inc., which operates the platform and runs its information security program. A financing application carries some of the most sensitive information a person has. This page sets out how that information is handled, and where work is still under way.
Controls
How the data is handled
-
Sensitive data never touches our systems
Social Security and bank numbers are entered into a dedicated tokenization vault ([VAULT_VENDOR] once contracted). ProLevelUp handles only tokens.
-
Encryption
TLS in transit; AES-256 at rest.
-
Merchant data separation
Each merchant's data is isolated at the database level, and that isolation is tested automatically on every code change.
-
Access control
Least privilege, multi-factor authentication, and dual approval for any emergency access to production.
-
Audit trail
Tamper-resistant logs of data access, configuration changes, consent events and routing decisions.
-
Three data zones
Your business data stays yours. Customers own their identity data and portability is opt-in. We use only de-identified aggregate statistics for benchmarks.
Tokenization
Sensitive details never reach us
Social Security and bank numbers are entered into a dedicated tokenization vault ([VAULT_VENDOR] once contracted). ProLevelUp handles only tokens, so the numbers themselves never sit in our systems. Your business data stays yours, customers own their identity data, and only de-identified aggregate statistics are used for benchmarks.
Our security program
Galaxian Inc. maintains a written information security program under the GLBA Safeguards Rule, covering risk assessment, access controls, vendor oversight, monitoring, staff training and incident response.
- SOC 2: [SOC2_STATUS]
- Penetration testing: [PENTEST_STATUS]
Where a status is not filled in, that work is not complete and we will not describe it as if it were.
Report a vulnerability
If you have found a security issue, email info@prolevelup.app with the subject Security. Please include enough detail for us to reproduce the issue. We publish a security.txt file at /.well-known/security.txt.
Who is responsible
Galaxian Inc., which operates ProLevelUp, runs the information security program and is accountable for the controls described on this page.
What we do with your information
Security is how we protect the data. The privacy policy says what we collect and why.