Security
Lever Decarb is in beta. This page says plainly how it protects your company’s data today, and what it doesn’t do yet. Last checked 21 October 2026.
Where your data lives
The app, its database and uploaded bills run on Railway, a cloud hosting company, in its US West region (San Francisco). Your data is held in the United States, not Australia.
In transit
The site is served over HTTPS, with a TLS certificate Railway issues for decarb.leverinstitute.org.
Signing in
- There are no passwords. You sign in with a link we email you, which works once and expires in 20 minutes.
- A session lasts 30 days in a cookie that page scripts can’t read. You can end every session at once from Account settings.
- We store only a one-way hash (SHA-256) of sign-in links, session tokens, guest tokens and invitations, so a copy of the database can’t be used to sign in.
- Sign-in emails, invitations and new guest companies are rate limited.
Keeping companies apart
Every page, action and export checks that the record belongs to your company before showing or changing it. Automated tests try to read and change another company’s records and check that nothing happens. Only your company’s owners can invite or remove people.
A small number of Lever staff have an admin login that can see every company. We use it to support you and run the service.
Who else handles your data
- Railway (hosting): everything in the app, as above.
- Anthropic (the Claude AI models), only when you use an AI feature with an account: each bill you upload, to read the figures from it; your company name and your answers to the disclosure questions, to draft report wording; and your company name with each measure’s title and figures, to word the opportunity register. Guests never send anything to an AI model.
- Resend (email): your email address and the sign-in or invitation email we send you.
Backups
The app copies the database once a day and keeps the last seven copies, on the same storage as the database. Lever staff also download a full copy, with uploaded bills, to keep somewhere other than our hosting provider. That’s done by hand, not on a schedule.
What we don’t have yet
- No ISO 27001 or SOC 2 certification.
- No multi-factor sign-in or single sign-on.
- Edits to readings and report sections are recorded, but there’s no full audit log of every change.
- No encryption at rest of our own, beyond what the hosting provider does.
Questions or a problem
If you have a security question or think you’ve found a problem, contact the Lever Institute through leverinstitute.org. See also our privacy statement and terms.