Is this your company? Buyers are checking Levity AI GmbH here. Claim levity.ai free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Levity AI GmbH
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Levity AI GmbH is SOC 2 Type II compliant. Levity AI GmbH also holds ISO 27001, and GDPR.
About
Levity is building workflow automation software for the AI age
Compliance & infrastructure
Hosting
AWSGCP
Documents
20Documents
- ISO 27001:2022 | Audit Report (December 2025)Request
- Penetration Test & Remeditation (January 2026)Request
- EU AI Act Risk Classification & ComplianceRequest
- Access Control Policy (EN)Request
- Asset Management Policy (EN)Request
- Business Continuity and Disaster Recovery Plan (EN)Request
- Code of Conduct (EN)Request
- Cryptography Policy (EN)Request
- Data Management Policy (EN)Request
- Human Resource Security Policy (EN)Request
- Incident Response Plan (EN)Request
- Information Security Policy (AUP) (EN)Request
- Information Security Roles and Responsibilities (EN)Request
- Operations Security Policy (EN)Request
- Physical Security Policy (EN)Request
- Risk Management Policy (EN)Request
- Secure Development Policy (EN)Request
- Third-Party Management Policy (EN)Request
- ISMS Certificate v1.0 - Levity AI - 2024.pdfRequest
- 11-ISMS Statement of ApplicabilityRequest
Subprocessors
4- AAmazon Web Services · Cloud provider
- GGoogle Cloud Platform · Cloud provider
- TTemporal Technologies Inc. · Data storage and processing
- OOpenAI · Engineering
Compliance leadership
The person who leads Levity AI GmbH's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Levity AI GmbH's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Levity AI GmbH SOC 2 compliant?
Levity AI GmbH is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Levity AI GmbH ISO 27001 certified?
According to Levity AI GmbH's public trust center, Levity AI GmbH is ISO 27001 certified. On SOC2C this listing is Listed.
Is Levity AI GmbH GDPR compliant?
According to Levity AI GmbH's public trust center, Levity AI GmbH is GDPR compliant. On SOC2C this listing is Listed.
Is Levity AI GmbH SOC 2 Type I or Type II?
Levity AI GmbH is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Levity AI GmbH's SOC 2 for a vendor risk assessment?
Yes. Levity AI GmbH's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Levity AI GmbH penetration tested?
Levity AI GmbH hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Does Levity AI GmbH have an ISO 27001 certificate?
Levity AI GmbH publishes an ISO certificate on its trust center; you can request access through SOC2C.
Is Levity AI GmbH secure?
Security isn't a single yes/no, but Levity AI GmbH is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Levity AI GmbH have a bug bounty or vulnerability disclosure program?
Levity AI GmbH hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@levity.ai or via a /security page (Levity AI GmbH lists a security contact).
Who are Levity AI GmbH's subprocessors?
Levity AI GmbH lists 4 subprocessors on its trust center, including Amazon Web Services, Google Cloud Platform, Temporal Technologies Inc., OpenAI. Buyers use this for fourth-party risk review.
Where does Levity AI GmbH host or store data?
Levity AI GmbH hosts on AWS, GCP. Data residency details are on its trust center.
Where is Levity AI GmbH's trust center or security page?
Levity AI GmbH's trust center is at https://trust.levity.ai. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Do you have ISO 27001 certification, and what is the certified scope?
Yes. Levity has an ISO/IEC 27001:2022 certificate originally issued on December 13, 2024 with annual recertification (latest: December 19, 2025). The certified scope covers the ISMS supporting provision, implementation services, and support of the Levity AI App (SaaS), including Executive Management, Finance/Operations, Engineering/Product, GTM/Sales, and Customer Support.
How do you manage information-security risk and control improvements?
Levity maintains an ISMS with risk assessment, risk treatment, internal audit, management review, corrective action, and continual-improvement processes. Risks are assessed for likelihood and impact and treated through mitigation, acceptance, transfer, or avoidance.
Do you perform penetration testing and remediate findings?
Yes. The available external application penetration test evidence covers testing conducted in November 2025 and a January 11, 2026 retest. The report records a low residual application-surface risk and confirms that the three identified findings were fixed on retest.
How is customer data classified and protected?
Customer data and PII are classified as Confidential. Confidential data is restricted to approved roles, may not be stored in non-production environments, must be encrypted at rest and in transit over public networks, and must be handled under data-owner approval and contractual controls.
How do you control employee and administrator access to customer data?
Levity uses least privilege, role-based access control, documented access grants, encrypted remote connections, and MFA for privileged access to production infrastructure. Application access controls are evaluated based on data sensitivity, unauthorized-access risk, output restrictions, and logging/auditing needs.
How do you handle retention, deletion, and contract termination?
Levity retains data only as long as there is a business, contractual, or regulatory need. PII is deleted or de-identified once it no longer has a business use, and PII is securely deleted after contract termination according to policy, contractual commitments, and applicable laws. Verified deletion requests are handled unless a legitimate business or legal retention basis applies.
Who has access to customer data?
Access is limited to authorized personnel and approved third parties/subprocessors. Suppliers that may access confidential data, systems, or networks require due diligence, written agreements, confidentiality responsibilities, and periodic review of security and service performance.
Is customer data used to train third-party AI models?
No. Customer data, including prompts, attachments, extracted entities, and logs, is not used by default to train Levity foundation models or third-party provider models. Customer-specific training or fine-tuning should occur only under a customer-approved scope and only for that customer's deployment.
How does Levity classify its AI systems under the EU AI Act?
The current EU AI Act analysis classifies Levity's use cases as Minimal Risk because they are administrative/commercial workflows and do not fall into Annex III high-risk categories. Autonomous data processing remains within human-defined guardrails and can be deactivated or overridden.
What controls mitigate hallucinations, low-confidence extraction, or incorrect AI output?
AI outputs should be treated as untrusted until they pass validation. The RFQ response set describes schema validation, constrained formats, confidence thresholds, source-span evidence, cross-field plausibility checks, business-rule checks, rate-source checks, and human review for exceptions.
How do you monitor systems and audit customer-impacting actions?
Production infrastructure is configured to produce logs for user activity, exceptions, faults, and security events. Logs should capture login/logout, CRUD actions on users and objects, security setting changes, administrator access to customer data, user ID, IP address, timestamp, action type, and object. Log information is protected against tampering and unauthorized access.
What is your incident-response process?
Security events are reported to [security@levity.ai](mailto:security@levity.ai) and classified by severity. Incidents are documented, assessed, remediated, and may include root-cause analysis and post-mortems. Customer, regulator, and data-subject notifications are made without undue delay where required by law, contract, or executive/legal determination. The IR plan is reviewed and tested at least annually.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public