Security and file handling

Release-gated product security

Security is part of the handoff

This marketing endpoint does not provide a public PartPack account or paid service. Product security controls described below apply only to a separately released production service and must be supported by the applicable customer order, security schedule and current deployment evidence.

Core controls apply to every production workspace. Plan-dependent controls are identified clearly, and assurance material is shared according to contractual and confidentiality requirements.

Core control

Identity and authentication

Every user has an individual account, and multi-factor authentication is available for all workspace members.

Enterprise workspaces can enforce single sign-on through SAML or OpenID Connect and require centrally managed authentication policies.

Core control

Workspace roles and tenant isolation

Role-based permissions separate workspace administration, package preparation, review, approval and supplier delivery actions.

Application and data-layer checks enforce workspace boundaries. Privileged production access is limited, logged and reviewed.

Core control

Encryption

PartPack encrypts customer data in transit using TLS 1.2 or later and at rest using industry-standard AES-256 encryption.

Encryption covers engineering files, application data and backups. Secrets and encryption keys are managed separately from application code.

Core control

Controlled supplier access

Supplier deliveries use high-entropy signed links with configurable expiry, recipient verification and immediate revocation.

Senders control the package and files shared with each recipient. Expired or revoked links no longer provide access.

Core control

File handling and validation

Uploads are checked for allowed file types, size limits and malicious content before they become available to a workspace or supplier.

Validation results, revision issues and accepted exceptions remain attached to the package record.

Core control

Audit trail

PartPack records material package activity, including file changes, validation outcomes, approvals, deliveries, supplier opens and downloads.

Audit events include the actor, action and timestamp and are protected from ordinary workspace modification.

Core control

Retention and deletion

Workspace administrators control operational retention, and deleted customer data is removed from active systems within 30 days.

Encrypted backup copies age out within 90 days unless law, a security investigation or an agreed customer schedule requires a different period.

Assurance practice

Backups and service recovery

Production data is backed up in encrypted, access-controlled systems separated from normal application access.

PartPack tests restoration procedures and reviews recovery controls as part of its continuity program.

Assurance practice

Monitoring and incident response

Security-relevant events are centrally logged and monitored, with a documented process for triage, containment, recovery and customer communication.

PartPack notifies affected customers without undue delay and follows applicable breach-notification laws, including Australia’s Notifiable Data Breaches scheme.

Assurance practice

Secure development and vulnerability management

Changes are reviewed and tested before release. Dependencies and production systems are monitored for known vulnerabilities.

PartPack prioritises remediation according to severity and uses independent penetration testing for material production releases.

Core control

AI processing and model training

PartPack does not use customer engineering files or personal information to train shared or third-party AI models.

If a customer enables an AI-assisted feature, PartPack identifies the processor and applies contractual restrictions on use and retention.

Plan dependent

Hosting, subprocessors and data location

The production hosting region and material subprocessors for a workspace are documented in the applicable order or security schedule.

PartPack reviews material providers before use and gives customers notice of material subprocessor changes where the agreement requires it.

Plan dependent

Security assurance

Current security documentation, independent test summaries and available assurance reports are provided according to the customer’s plan and confidentiality requirements.

PartPack does not claim a certification or compliance status unless the scope and current evidence support that claim.

Security assurance package

Customers completing technical or procurement diligence can request current documentation relevant to their service and plan. The review package may include:

1. Architecture, data flows and tenant-isolation controls.
2. Identity, SSO, MFA and least-privilege workspace permissions.
3. Hosting region, subprocessors, encryption, backups and recovery.
4. Retention, deletion, incident response and breach notification.
5. AI processing, penetration testing and current independent assurance.

Report a security concern

Report a suspected vulnerability, unauthorised access or security incident to security@levrtek.com. Include enough detail for us to reproduce or investigate the issue, but do not access data that is not yours or disrupt the service.