Snapshot 245310
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Security and Privacy Protecting the data of your organization and its customers is our top priority. Level Access upholds the highest security and privacy standards: We're ISO 27001 certified. The Level Access Platform and UserWay suite have successfully completed SOC 2 Type II audits, as we adhere to maintaining rigorous security, availability, and confidentiality controls. Explore our Trust Center to learn more! infosec@levelaccess.com Privacy PolicyOpens in new tab Filter by Level Access is the category leader in digital accessibility solutions. Our end-to-end approach combines an AI-powered platform with the deepest bench of subject matter expertise, delivering capabilities across the three pillars of successful digital accessibility programs: Audit & Test, Build & Fix, and Governance & Reporting. For more information about the Level Access solution, read the Level Access Platform OverviewOpens in new tab. Compliance SOC 2 ISO 27001:2022 FedRAMP Rev. 5 GDPR Resources View all Architecture Diagrams Level Access SOC 2 (2026) High-level Diagram (LAP, Widget Services - UW, Level CI) LAP Architecture Diagram (v1.3) Widget Services Architecture Diagram (2025) Level CI Architecture Diagram (v1.0) View 1 more Artificial Intelligence (AI) Level Access AI Transparency Statement AI PDF Auto Remediation Business Continuity Level Access Business Continuity Statement Level Access Business Continuity Test Record Level Access Incident Response Plan v4.3 CAIQ CAIQv4.1.0-star_security_questionnaire-generated_at_2026_01_13_LA01_PDF_EDITION FedRAMP FedRAMP AMP Rev. 5 Authorization Opens in new tab HECVAT HECVAT 4.10 (for Trust Center) Insurance Certificate of Insurance ISO Level Access SoA Level Access Information Security Policy Level Access ISO 27001 Certificate Penetration Tests Web Application Penetration Test (Level Access Platform) External Network Penetration Test SOC Level Access - 2026 - SOC 2 Type 2 Report - LAP, Widget, Level CI.pdf UserWay UserWay-Architecture High Level_PDFUA UserWay Accessibility Widget - Technical Whitepaper_UW01_ACC-PDFUA.pdf VPAT (ACR) View 2 more Controls View all Governance & Organizational Controls Production inventory maintained Password policy enforced Security policies established and reviewed View 65 more Governance & Organizational Controls controls People & Awareness Controls Employee background checks performed Security awareness training implemented Awareness View 15 more People & Awareness Controls controls Physical & Environmental Security Portable media encrypted Firewall access restricted Network firewalls reviewed View 10 more Physical & Environmental Security controls Technical & Infrastructure Security Unique production database authentication enforced Encryption key access restricted Unique account authentication enforced View 57 more Technical & Infrastructure Security controls Product & Application Security Penetration testing performed Secure development life cycle Application security requirements View 13 more Product & Application Security controls Data Protection and Privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established View 19 more Data Protection and Privacy controls Data collected Accessibility metadata Credit card information Personal health information Website form data Subprocessors View all DataDog, Inc. • SIEM USA Logging and operational monitoring; Security incident and event management Amazon Web Services • Cloud provider USA (Ohio and California) Infrastructure hosting for the software platforms; CDN Microsoft • Cloud provider USA Infrastructure hosting for the software platforms; CDN Amplitude, Inc. • User behavior analytics USA (California) Digital analytics software FAQ View all Updates View all Security PHP Critical Vulnerabilities (PHP2Shell) – No Impact to Level Access Published October 22, 2026 Level Access is aware of the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may allow unauthenticated remote code execution on affected PHP installations serving web requests. These vulnerabilities have been publicly identified as "PHP2Shell." Following an internal review, we confirmed that the Level Access Platform, UserWay Widget, and Level CI do not utilize PHP and are not impacted by these vulnerabilities. We also reviewed the limited number of internal systems that run PHP. Any affected systems have been updated to supported patched versions as part of our standard vulnerability management process. Based on our assessment, there is no impact to customer data, customer-facing services, or core Level Access products. As part of our ongoing security program, we continue to monitor guidance from the PHP project and industry security organizations and will take appropriate action should new information become available. If you have any questions or concerns, please let us know. Security Fortinet Credential Exposure (FortiBleed) – No Impact to Level Access Published June 23, 2026 Level Access is aware of recent CISA guidance regarding a global campaign targeting internet‑accessible Fortinet devices using compromised credentials (“FortiBleed”). Level Access does not use Fortinet firewalls or SSL VPN technology in our production environment and is not impacted by this activity. Customer data and Level Access systems, including the Level Access Platform, Level CI, and UserWay Widget, are unaffected. General Level Access Signs CSA AI Trustworthy Pledge Published June 15, 2026 Level Access has signed the Cloud Security Alliance (CSA) AI Trustworthy Pledge, joining organizations committed to advancing responsible and secure AI. The pledge represents a public commitment to developing and deploying AI systems in alignment with key principles, including safety, transparency, ethical accountability, and privacy protection. Level Access is publicly listed among participating organizations: View CSA AI Trustworthy Pledge signatoriesOpens in new tab By participating in this initiative, Level Access reinforces its approach to AI governance—prioritizing secure design, responsible use, and protection of customer data. This milestone supports our broader commitment to transparency and trust as we continue to evolve AI-enabled capabilities across our products and services. Security Datadog / axios npm Supply Chain Incident – No Impact to Level Access Published April 5, 2026 Level Access is not impacted by the recently disclosed npm supply chain incident involving malicious versions of the axios package (versions 1.14.1 and 0.30.4), which Datadog reported may affect certain Datadog open‑source CI/CD and serverless tooling. After internal review, we confirm that Level Access does not use the affected Datadog packages or installation methods associated with this incident. We have additionally scanned our environment and found no instances of the malicious axios versions or related indicators of compromise. Based on our assessment, there is no impact to Level Access systems, products, or customer data. No mitigation actions are required at this time. As part of our ongoing security program, we continue to monitor updates from Datadog and relevant security intelligence sources and will take appropriate action should the situation change. If you have any questions or concerns, please be in touch. Media View all Welcome to the Level Access Trust Center! Opens in new tab Take a quick guided tour of our Trust Center and discover the security, privacy, compliance, and governance resources available to customers and prospects. This brief video overview highlights how to access key documentation, review our security program, and find answers to common trust and transparency questions.