Lebra Technologies Inc

Lebra Technologies Inc's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Lebra Technologies Inc publishes a DPA on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Lebra Technologies Inc is SOC 2 Type II compliant and holds SOC 2 Type II, NIST CSF. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Lebra Technologies Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@lebrahq.com or via a /security page (Lebra Technologies Inc lists a security contact).

Lebra Technologies Inc lists 8 subprocessors on its trust center, including GitHub, Amazon Web Services, Supabase, Nylas, Inc., Vanta. Buyers use this for fourth-party risk review.

Lebra Technologies Inc hosts on AWS, GCP, and handles Customer personally identifiable information, Credit card information, Personal health information, Student data. Data residency details are on its trust center.

Lebra Technologies Inc publishes a DPA on its trust center. You can request access through SOC2C.

Lebra Technologies Inc's trust center is at https://trust.lebrahq.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

- We use Supabase, built on top of AWS, so essentially AWS for our database provider. We don’t house any data outside of this. - Supabase is SOC2 type 2 and HIPAA complaint. Added security, even though Lebra does not store any HIPAA information. - Supabase data is encrypted at-rest at the storage level using AES256 (advanced Encryption Standard). - Resources: Security at Supabase - Resources: Cloud Security – Amazon Web Services (AWS) - Additionally, health systems use AWS to store HIPAA data: \Epic on AWS | Healthcare & Lifesciences Solutions ([amazon.com)\](https://aws.amazon.com/health/solutions/epic/#:~:text=Epic customers can leverage AWS,controls in the AWS cloud.)) - ChatGPT-4 API - The OpenAI API, which we use, has been evaluated by a third-party security auditor and is SOC 2 Type 2 compliant. - An added benefit of the API is security and privacy. Unlike the use ChatGPT without an API, the data submitted through our API to OPENAI is not used to to train OpenAI models. (See below). - Resources: Security (openai.com)

- Your data is your data. We never sell your data to third parties. - We force all API transactions to use HTTPS protocol. - All of our servers and databases are hosted in the US with SOC 2 and ISO 27001 certified providers. - We maintain complete, regular backups of user data to prevent data loss.

Yes, you will be able to archive records. If you need reports ran, we do that on our end.

The AI in the Lebra platform primarily uses SSM's data to personalize and enhance the employee engagement experience. This includes leveraging details like employee birthdays, names, titles, and past notes/follow-ups. The AI analyzes this data to perform three functions at the moment 1) to generate customized outreach given a specific subject using 'AI assistant' functionality' 2) to generate a relevant agenda using the 'Daily Agenda' functionality and 3) to generate relevant responses in the Lebra "Assistant", which may be provided queries of various forms. In total, these data are used to provide relevant suggestions, reminders, and insights, aiming to foster a more engaged and cohesive work environment.

In the case of Lebra, which utilizes GPT-4 created by OpenAI, certain SSM data is indeed shared with OpenAI, a prominent AI research and deployment company. This sharing is essential for the functioning of the AI model within the platform. However, it is important to note that such data sharing is governed by specific agreements, including the OpenAI "Business Terms" (OpenAI Business Terms). These terms typically outline the scope, limitations, and protections related to data sharing and usage.