Security

The current public website is deployed through Netlify, uses encrypted HTTPS transport in production, validates contact and careers submissions on the server, and keeps mail credentials in deployment environment variables rather than browser code. The contact endpoint also uses a Netlify edge rate limit to reduce automated abuse. These are website safeguards, not a certification or a description of controls for every future client system.

Security scope is established through discovery and documented in the applicable statement of work. The assessment considers data sensitivity, user roles, system boundaries, third-party dependencies, regulatory context, and the client's existing controls.

When included in an agreed scope, LYVATE's delivery model can use practical safeguards appropriate to the project.

• Least-privilege access and role-based permissions.
• Multi-factor authentication and managed credentials.
• Encrypted transport and appropriate protection for stored data.
• Code review, dependency checks, testing, and deployment controls.
• Secrets management, logging, monitoring, and incident-response planning.

AI-enabled workflows should define approved data boundaries, human review points, evaluation criteria, audit evidence, exception handling, and rollback paths before they are trusted with sensitive or customer-facing operations.

Security is shared. Clients remain responsible for accurate system and data classification, timely access decisions, their users and credentials, approval of risk decisions, and operation of controls outside LYVATE's agreed scope.

LYVATE can design delivery toward GDPR, ISO 27001, SOC 2, HIPAA, or client-specific control objectives where they apply. This page does not state that LYVATE or every delivered system is independently certified. Any required framework, audit evidence, or certification support must be expressly included in the engagement scope.

If you believe a LYVATE-managed website, system, or communication presents a security concern, contact us with the affected asset, a concise description, and safe reproduction details. Do not include credentials, personal data, or exploit material in an initial message.