Security and access controls for your MCA workspace.
NextLevel maintains its own MCA data layer and provides role- and permission-based access to records and developer connections. This page describes verified controls; ask us about any requirement not covered here.
ESOF Shield CertifiedHow Your Data Is Organized
GoHighLevel is the CRM and communications layer. NextLevel MCA is the system of record for your MCA data.
- Businesses, people, deals, documents, statement analysis, lenders, submissions, offers, advances and commissions are NextLevel records
- MCA records are not stored in GoHighLevel custom fields or custom objects
- API keys and AI assistant connections are scoped to one workspace
- CRM contacts, conversations, texting, calling and email marketing live in the GoHighLevel sub-account included with your plan
- People in NextLevel are linked to CRM contacts
- Notes and tasks on businesses and deals sync to the CRM
- NextLevel opens from the CRM's left menu and signs you in from your CRM session, with no second password
- The phone app is installed to your home screen from app.nextlevelmca.com and signs in with a Mobile PIN
- PIN sign-in only works from the installed app
Protecting Sensitive Information
- Social Security numbers are encrypted at rest and never returned by the API (only the last four digits, masked)
- Integration credentials for DataMerch, PACER, CRS and lender API connections are stored encrypted
- The REST API is HTTPS only
- Webhook payloads are signed with HMAC; they carry event summaries and never the application form, SSNs or dates of birth
- Lenders receive watermarked copies of bank statements, and email submission packages carry a per-lender reference code
- Merchant portal links expire after 24 hours, and regenerating stops every live link for that business
- Admins see everything; Managers see their own deals, their reps' deals and unassigned deals; Reps see deals where they are the originator or closer
- Per-person permissions for deals, submissions, offers, advances, lenders, commissions, reports, settings and team
- Permission templates (Sales Closer, Sales Originator, Sales Manager, Operations / Back Office, View Only) or your own
Developer and AI Assistant Access
- Stored hashed and shown only once, when created
- Each key has a role (admin, manager or user) and optional scopes
- Keys can be set to expire and can be revoked at any time
- Assistants connect with OAuth 2.1, and you approve scopes on a consent screen
- An assistant acts as the signed-in person, with their role and view of the pipeline; a scope never grants more than that role allows
- Tools that send real messages to lenders or merchants are marked for confirmation, so chat assistants such as Claude and ChatGPT ask before using them
- Revoke connections under Settings > Developers > Connected apps; deactivating a team member ends their connections
- Each deal's activity log records field changes, emails, submissions, offers, documents, stage moves and merchant portal actions
- No one on your team can edit or delete entries
- The log is searchable and exportable, and viewing it requires the View Activity Logs permission
- DataMerch, PACER and CRS credit pulls use your brokerage's own provider accounts, and provider fees are billed by the provider
- Lender emails go from your own connected Gmail or Outlook mailbox
- API submissions use supported lender connections that NextLevel configures for your workspace, with credentials stored encrypted
- Export deals and lenders to CSV, and export the activity log
- Read your records through the REST API
- For an account-level export or a deletion request, email support@nextlevelmca.com
Security Is a Partnership
Steps your team can take to keep your workspace protected:
- Protect your GoHighLevel login, since it is how your team opens NextLevel
- Review team member roles and permissions regularly
- Revoke API keys and AI assistant connections you no longer use
- Disconnect mailboxes you no longer use
- Report suspicious activity to support@nextlevelmca.com
Security FAQs
Your MCA records (businesses, people, deals, documents, lenders, submissions, offers and advances) live in NextLevel's own data layer, not in GoHighLevel custom fields or objects. CRM contacts and conversations live in your GoHighLevel sub-account. For hosting and subprocessor details, email support@nextlevelmca.com.
Admins see everything. Managers see their own deals, their reps' deals and unassigned deals. Reps see deals where they are the originator or closer. Back-office staff can be given the View All Deals permission.
Revoke API keys under Settings > Developers > API keys, and AI assistant connections under Settings > Developers > Connected apps. Deactivating a team member also ends their assistant connections.
You can export deals and lenders to CSV, export the activity log, and read your records through the REST API. For an account-level export or a deletion request, email support@nextlevelmca.com.
This page describes verified controls only. Email support@nextlevelmca.com with your questionnaire or requirement and we will tell you what we can confirm.
Have a Security Question?
This page describes verified controls; ask us about any requirement not covered here.
support@nextlevelmca.com