HighLevel security, data and export: what you control

Updated 2026-09-19

In HighLevel you control user access by role and by sub-account, can require two-factor sign-in, and can export contacts, conversations and most records; workflows, funnels and account settings are not exported as portable files, so document them separately. Your data stays yours under the published terms, and the cancellation page covers what to take before you leave.

Access and roles

Users are granted access at the agency level or the sub-account level, and an agency-level user can see every client sub-account underneath it unless that access is deliberately restricted. Two-factor authentication is available for account sign-in, supports authenticator apps, and can be made mandatory for every user by an administrator, as at September 2026. Run this as a day-one checklist item: confirm who holds agency-level access, and turn on two-factor before anyone starts entering client data.

What is encrypted and certified

HighLevel states its infrastructure runs on Google Cloud Platform and Amazon Web Services, both US-hosted. Data in transit uses TLS 1.2 or 1.3 with a minimum 2,048-bit key, and platform data at rest uses AES-256 encryption, as at September 2026. HighLevel also states it holds SOC 2 Type II certification and runs annual penetration testing against its own application and infrastructure. Treat any requirement not confirmed in current documentation, such as a specific data-residency commitment outside the US, as unmet until it is confirmed directly.

Compliance is shared, not automatic

HighLevel states plainly that using the product alone does not make a business GDPR compliant; the customer carries responsibility for its own compliance obligations, with the platform providing features to support that rather than guaranteeing it. The same logic applies to health data: an account is not HIPAA compliant by default, and the compliance add-on is a separate purchase with its own permanent obligations once turned on. See HighLevel and HIPAA for what that add-on covers and costs.

Exporting your data

HighLevel states it provides export options across the portal and through its public API for contacts, conversations and most records. What does not export as a standalone file is your workflow logic, funnel structure and account settings; those live inside the platform's own configuration rather than as a downloadable document. The practical fix is documentation: keep a written or screen-recorded record of how your key workflows and pipelines are built, separate from the account itself, so a cancellation or a migration does not mean rebuilding from memory.

The checklist to run in the first hour

Confirm which users hold agency-level access and remove anyone who should not have it. Turn on two-factor authentication for every user. Export a sample of contacts and conversations to confirm the export process works before you need it under pressure. Write down, outside the account, how your core pipeline and your enquiry workflow are built.

Questions people ask

Is HighLevel secure?

It states TLS and AES-256 encryption, SOC 2 Type II certification and annual penetration testing, as at September 2026. Security features exist; using them correctly, roles, two-factor and access review, is the customer's responsibility.

Who can see my data?

Anyone with agency-level access can see every sub-account underneath it unless that access is restricted. Review this list directly rather than assuming it is limited.

Can I export everything?

Contacts, conversations and most records export through the portal or the API. Workflows, funnel structure and settings do not export as portable files; document those separately.

Where is my data stored?

On US-based infrastructure through Google Cloud Platform and Amazon Web Services, as stated by HighLevel as at September 2026. No separate regional data-residency option is confirmed in current documentation.

What happens to my data if I cancel?

Export contacts, conversations and records before cancelling; see cancel for the full sequence and what to take first.

Pages in this section

Not sure yet? Start here