Security
What Lift Right does, stated plainly, including what it does not do.
Access
| Control | Status |
|---|
| Row-level security | Enforced on every application table |
|---|
| Enforcement layer | Database, on every query, not the interface |
|---|
| Caseworker scope | Own caseload only |
|---|
| Administrator scope | Own organization only |
|---|
| Participant scope | Their own record only |
|---|
| Cross-organization access | None |
|---|
| Administrator tiers | Two. Same visibility, different authority |
|---|
| Withheld from program-tier admins | Grants, finalising funder reports, staff changes, programs, org thresholds, intake questions, support access |
|---|
Sign-in
| Control | Status |
|---|
| Sign-in methods | Emailed 6-digit code, Google, Microsoft, a passkey, or a password |
|---|
| Passkey | Fingerprint, face, or device PIN. Works only on our domain |
|---|
| Lost passkey | Reset by an administrator at your own organization |
|---|
| Lost authenticator app | Reset through Lift Right support, arranged by your administrator |
|---|
Consent and disclosure
| Control | Status |
|---|
| Consent records | Scope, purpose, named recipient, expiry, onward-sharing permission, revocation |
|---|
| Disclosure log | What was shared, with whom, under which consent |
|---|
| Disclosure under expired or revoked consent | Refused by the database |
|---|
| Referral with no consent on file | Allowed, and permanently recorded as your decision, with your name and the time |
|---|
| Cover sheet | Printable, states authority, purpose, expiry, onward-sharing |
|---|
What is never collected
| Field | Status |
|---|
| Immigration status | Never asked, never stored. No field exists |
|---|
| Social Security number | Not collected |
|---|
| Precise location | Not collected |
|---|
| Criminal history detail | Not collected |
|---|
Data handling
| Control | Status |
|---|
| Deleting a participant | Not available in the interface |
|---|
| Removing someone from active work | Archive. History stays intact |
|---|
| Actual deletion | Legal or regulatory demand only, handled case by case |
|---|
| Documents | Private storage |
|---|
| Document links | Expire after five minutes |
|---|
| Document expiry dates | Warned before they lapse |
|---|
AI features
| Control | Status |
|---|
| Access to participant records | Some features. Name, email and phone removed first. |
|---|
| Access to case notes | Some features. Restricted records never. |
|---|
| Access to another organization’s data | None |
|---|
| Source of answers | Our help content, and industry news if switched on. |
|---|
| Model training on your content | No |
|---|
| Can be switched off per organization | Yes for most features, by a full administrator. |
|---|
Subprocessors
| Control | Status |
|---|
| Full list published | Yes, on the Subprocessors page |
|---|
| Location | United States companies and storage. AI processing may run in another country. |
|---|
| Training on customer data | None |
|---|
| Notice before a new subprocessor | 30 days |
|---|
What we do not have
| Item | Status |
|---|
| SOC 2 | Not certified |
|---|
| ISO 27001 | Not certified |
|---|
| Penetration test report | Not yet |
|---|
| Security questionnaire | We will complete yours on request |
|---|
| Review with your IT team | Available on request |
|---|
We would rather say that than imply otherwise. When we find a gap between what we say and what the product does, we correct what we say right away and put the product fix on our roadmap.
Reporting a problem
| Item | Detail |
|---|
| Where | security@getliftright.com |
|---|
| Acknowledgement | Within one business day |
|---|
| Bug bounty | None |
|---|
| Good-faith reports | Never threatened, never pursued |
|---|
Last reviewed 26 October 2026.
