Your clients’ data is safe.
Here’s exactly how.

Leveridge handles sensitive client information: tax returns, property records, income data. This page explains exactly what we do with it, how we protect it, and what we never do with it.

Tax return PDFs are never stored. We extract the numbers and delete the file from memory within 60 seconds of completion. No PDF archive exists anywhere in our systems.

AI never trains on your clients' data. We use Amazon's AWS Bedrock, which has a zero data-retention policy. Model providers have zero access to your data.

Your clients' data belongs to you. We process it solely to provide the service you contracted for. We do not sell it or share it for any purpose other than operating the platform.

Everything is encrypted. Data at rest uses AES-256. All data in transit uses TLS 1.3. Passwords are never stored in readable form.

No other advisor can see your clients' data. Data isolation is enforced at the database layer. One advisor's data is never accessible to another.

Last reviewed: May 2026 · Questions? security@leveridge.ai

Tax Return Processing: How It Actually Works

The PDF is held in memory during extraction and deleted within 60 seconds of completion.

01

Upload

The file is received into application memory only. It is never written to disk.

02

Fingerprint

A digital hash of the file is created for duplicate detection. We check if you've uploaded this file before.

03

AI Extraction

The PDF is sent to Amazon's AI service (AWS Bedrock) running within our private AWS environment. It extracts the financial data we need.

04

Data Saved

Only the structured financial data is saved to your account. Everything else is discarded.

05

PDF Deleted

All references to the PDF are released from memory. The file no longer exists anywhere in our systems: not on disk, not in cloud storage, not in any backup.

What we save

Household income and deductions

Property addresses and rental income

Expense categories and amounts

Tax year and filing status

Depreciation details

File name and fingerprint (advisor reference and duplicate detection)

What we never save

The PDF file itself, ever

Social Security Numbers

Signatures, handwritten notes, or annotations

W-2s, 1099s, or other attached source documents

Any data not needed for property analysis

If our database were ever breached, the attacker would find structured financial summaries. The same type of information in any financial planning file. There is no document archive, no scanned images, no original tax returns. You cannot steal what does not exist.

How We Use AI — Full Disclosure

Leveridge uses AI for two specific purposes: tax return data extraction and property analysis insights. We use Amazon Web Services Bedrock, AWS’s managed AI inference service, operating entirely within our private AWS environment.

Does the AI store our clients' information?

No. Zero retention policy.

Can AI model providers see our data?

No. They provide model weights only. Your data never leaves AWS infrastructure.

Is client data used to train AI models?

Never. Not by Leveridge, not by AWS.

Is tax return data used to train AI?

Never. The PDF is deleted before any training pipeline could access it.

Does a human review AI outputs before they reach clients?

Yes. Advisors review all analysis before sharing with clients.

What data is sent to AI during tax extraction?

The PDF content for a single request, deleted from AI context immediately after.

These are contractual commitments in our AWS service agreement. AWS Bedrock is covered by AWS’s SOC 2 Type II and ISO 27001 certifications.

Security Controls at a Glance

Encryption at rest (AES-256)

Active

Encryption in transit (TLS 1.3)

Active

Password hashing (bcrypt)

Active

Tax return PDFs never stored

By design

AI zero-retention policy (AWS Bedrock)

Contractual

Client data used to train AI models

Never

Role-based access control

Active

Multi-factor authentication — critical systems

Active

Multi-factor authentication — all systems

Active

Multi-factor authentication — application users (TOTP)

Available

AWS Web Application Firewall

Active

AWS CloudTrail audit logging

Active

72-hour breach notification commitment

Committed

SSNs extracted or stored

Never

Data stored outside the United States

Never

All production code reviewed before deployment

Active

Dependencies scanned for known vulnerabilities

Active

Critical vulnerability patches applied within 7 days

Active

Third-party penetration testing (results available to clients under NDA)

Scheduled — Q3 2026

SOC 2 Type I

Targeted — Q3 2026

SOC 2 Type II

Targeted — Q2 2027

Infrastructure & Subprocessors

Leveridge runs entirely on Amazon Web Services (AWS), US-West-1 (Northern California). All data processing and storage occurs within the United States.

Vendor

What they do

Data retention

AWS

Hosting, storage, and infrastructure

Encrypted at rest; deletion managed by Leveridge on request

AWS RDS (PostgreSQL)

Client data database

Encrypted; SOC 2 Type II certified

AWS Bedrock

AI processing (tax extraction, insights)

Zero retention, deleted after each request

Property data provider

Property valuations and market data

Property address queries only

Stripe

Payment processing (when billing launches)

Billing information only; PCI DSS Level 1

Leveridge personnel access

Leveridge personnel do not access client data as part of normal operations. A small number of team members in engineering and operations can access client data in limited circumstances: when an advisor requests support assistance, to debug and troubleshoot platform issues, and where required by law. All such access is MFA-enforced and logged via AWS CloudTrail.

Availability & backups

Leveridge runs on AWS across multiple availability zones with automated database failover via AWS RDS. Client data is backed up on an encrypted, automated schedule. A written Business Continuity Plan covers vendor outage contingencies and service restoration procedures.

Data Retention

Active account

Retained while account is active

After account closure

30-day grace period; permanently deleted at day 30; backups purged within 90 days

Tax return PDFs

Never retained. Deleted from memory within 60 seconds of extraction completion

Temporary exports (PDFs generated by the platform)

Auto-deleted after 24 hours

Security audit logs

2 years (compliance requirement)

Leveridge is not your books-and-records custodian.

SEC Rule 204-2 requires RIAs to maintain books and records, typically 5 years for most records. This obligation belongs to your firm, not to Leveridge. Leveridge provides data export in JSON, CSV, and PDF formats at any time. We recommend establishing a regular export cadence as part of your firm’s recordkeeping program.

Supporting Your Compliance Program

Your firm’s compliance obligations under GLBA and SEC Regulation S-P require you to vet and monitor your technology vendors. We support that with:

This document for your vendor oversight file

Our full Information Security White Paper, available on request at security@leveridge.ai

Responses to vendor security questionnaires (SIG Lite, SIFMA, or your firm's custom format) within 5 business days

Compliance review calls and support for SEC examinations

A note on our certifications

We are an early-stage company and do not yet hold independent certifications. We are honest about that. Our security program is designed in alignment with the GLBA Safeguards Rule, NIST Cybersecurity Framework, and SOC 2 Trust Services Criteria, though we do not claim formal certification at this stage. SOC 2 Type I is our near-term target (Q3 2026), with SOC 2 Type II targeted for Q2–Q3 2027. AWS holds the certifications relevant to the underlying infrastructure layer, including AWS RDS (PostgreSQL).

Report a Security Issue

If you believe you’ve found a security vulnerability in Leveridge, we want to know. Please report it to security@leveridge.aiand we’ll acknowledge your report within 1 hour during business hours (4 hours outside business hours).

We will not pursue legal action against researchers who report vulnerabilities in good faith.

Questions or due diligence requests

We respond to security questions and vendor questionnaires within 5 business days. To request the Information Security White Paper or submit a security questionnaire, email us directly.