How Rockstar Designs protects your accounts, your data and your customers. Serious security, honest boundaries and a clear line between what we handle and what our platform provider handles.
Rockstar Designs is a white label reseller and service provider built on HighLevel. HighLevel runs the core platform and infrastructure. We configure the accounts, workflows, integrations, permissions, AI experiences and support that run on top of it.
HighLevel runs hosting, network defenses, application security, backups and monitoring.
We manage customer configuration, authorized access, support and responsible data handling.
You control your users, content, lawful data collection, communication consent and business decisions.
Platform claims link straight to HighLevel's current sources so you can verify them yourself.
Built for the size, complexity, technology, services and data handling of our business. The goal is simple: protect the confidentiality, integrity and availability of information.
Assign accountability, review material risks, document decisions and update safeguards as operations change.
Least privilege, strong authentication, approved systems, security updates, alerts and logs.
Contain incidents, coordinate with providers, communicate, restore and improve.
Governance: Executive leadership owns the program. It is reviewed at least once a year and after any material incident, major service change or significant new risk.
We don't operate the data centers or core infrastructure. HighLevel states its infrastructure is in the United States and runs on Google Cloud Platform and Amazon Web Services.
Layered filtering, logical firewalls, security groups, deny by default rules, a web application firewall and DDoS protection.
Central event logging with automated detection of anomalies, attacks, errors and abuse.
Code review, automated testing, static analysis, separate QA, controlled releases and rollback.
Regular vulnerability scanning plus annual penetration testing of the platform.
HighLevel states data in transit uses TLS 1.2 or 1.3 with 2,048 bit keys or better.
Stored platform data uses AES 256 with keys in hardened key management systems. Passwords are hashed and protected at rest, per HighLevel.
We rely on HighLevel's published documentation and contracts for these controls. We do not independently audit HighLevel's infrastructure.
We configure AI for customer authorized purposes: answering inquiries, qualifying leads, scheduling, routing, customer service and workflow help. Nothing more.
HighLevel's privacy policy states its AI features provide direct services rather than training generalized public models, and that AI subprocessors may use data only for the selected service. Providers can change, so review HighLevel's current materials.
We collect, access, use and keep information only as far as it's reasonably needed to deliver, support, secure and improve the services you authorized.
HighLevel generally acts as a processor or service provider for data customers upload. Depending on the relationship and the law, we and our customers may be controllers, businesses, processors or service providers.
HighLevel is our principal platform provider. Other providers may support communications, AI, payments, productivity, analytics or integrations you request.
We keep information as long as reasonably needed for services, support, records, disputes, security and legal or contractual obligations.
HighLevel maintains its own vendor risk program and subprocessor list. Those are HighLevel controls, not Rockstar certifications.
Covers any suspected or confirmed event involving accounts, configurations, integrations, devices or information. Platform incidents are escalated to HighLevel or the responsible provider.
Receive, validate, classify, document and assign the event.
Limit access, revoke sessions, reset credentials or suspend integrations.
Find the scope, affected information, timing, cause and responsible provider.
Fix the access, configuration, device, workflow or provider issue.
Restore service safely, confirm safeguards and watch for recurrence.
Document lessons learned and update controls, procedures or training.
We notify affected customers as required by law and contract. HighLevel states it notifies customers as required by law when it becomes aware of a breach affecting personal data.
Access is granted by role, customer authorization, business need and least privilege. Passwords alone are not enough, and we plan to recover, not just react.
Response priorities, backup communication methods, access recovery procedures and resilience from approved cloud providers.
HighLevel states its platform supports granular permissions, logs relevant activity, enforces a password policy, supports two factor authentication and lets administrators require it for every user.
These are HighLevel's published capabilities. They do not certify Rockstar Designs or any customer.
| Standard | What it means | Who it covers |
|---|---|---|
| SOC 2 Type II | Annual assessments of security, availability and confidentiality. | HighLevel attestation. Rockstar is not independently SOC 2 attested. |
| ISO/IEC 27001:2022 | Information security management certification listed in HighLevel's Trust Center. | HighLevel certificate. Does not certify Rockstar. |
| Data Privacy Framework (EU and U.S.) | Covers HighLevel's participation and covered processing. | HighLevel certification. Not automatic for Rockstar. |
| GDPR and privacy tools | Privacy tools and processor terms. Using the platform alone doesn't make you compliant. | Platform support |
| HIPAA | Accounts are not HIPAA compliant by default. The add on, BAAs, configuration and your own compliance are required before any PHI use. | Optional paid capability |
| PCI DSS | HighLevel states it is not PCI DSS compliant and uses PCI compliant payment processors. Never store card data in the CRM. | Payment processors |
Procurement teams and auditors should use HighLevel's current materials and request controlled documents through its Trust Center.
Public security and compliance overview.
OpenDetailed platform security information.
OpenCompliance materials. Some may require sign in.
OpenHighLevel's description of its attestation.
OpenPrivacy roles, processing, AI and data use terms.
OpenAvailability and incident updates.
OpenNo. We don't claim an independent Rockstar attestation. HighLevel publicly states it goes through annual SOC 2 Type II assessments.
HighLevel, on United States infrastructure from major cloud providers. Rockstar Designs manages configuration, delivery and operational access.
Yes. In transit with TLS 1.2 or 1.3 and at rest with AES 256, per HighLevel. Encryption outside the platform depends on the service or integration involved.
Yes, per HighLevel, and portal administrators can require it. We use MFA on our material systems wherever it's supported.
Yes. HighLevel runs annual penetration testing plus regular vulnerability scanning. These are HighLevel controls.
Not by default. HIPAA capability is an optional paid add on, and the right agreements, configuration, your own compliance program and our written approval are required first.
No. Compliance depends on your use case, notices, consent, contracts, configuration, team, processes and the laws that apply to you.
Email [email protected] right away with the affected customer or system, the dates and times involved and a clear description. Never send passwords, verification codes, private keys or unnecessary sensitive data.
Reach out right away if an account, configuration, integration, communication channel or customer record may have been accessed, shared or used without authorization. Include what happened, the affected customer or system, the dates and times and how to reach you.
Never send passwords, codes or sensitive data by email.
Important notice: This page describes general practices. It is not a warranty, certification, service level commitment or guarantee against incidents or interruptions. Specific obligations are governed by written agreements and applicable law. HighLevel is an independent provider, and its names, certifications and statements belong to HighLevel. HighLevel's certifications and infrastructure controls apply to the HighLevel platform and are not certifications of Rockstar Designs LLC. Platform information was last reviewed against official HighLevel sources on July 23, 2026 and may change.