By Alpit Patel and the aibrevo team · October 15, 2026 · Updated October 28, 2026 · 10 min read
Is GoHighLevel Legit? Who Owns It, Its Security, and the ClickFunnels Lawsuit
Quick answer
Yes. HighLevel is a real software company founded in 2018 and based in Dallas, Texas, with a published SOC 2 Type II attestation and a US growth-equity investor. The 'scam' searches come from reseller hype, billing surprises and message-compliance problems, not from the platform being fake. The one lawsuit we verified, ClickFunnels v. HighLevel, ended with the Federal Circuit affirming dismissal on July 2, 2026.
Part of the guide: GoHighLevel expert for hire: scope, price and vetting
Key takeaways
- GoHighLevel is legitimate software sold by HighLevel Inc., founded in 2018 by Shaun Clark, Varun Vairavan and Robin Alex, with a Dallas, Texas headquarters. A General Atlantic press release from April 11, 2024 describes the three as co-founders and largest shareholders.
- HighLevel publishes a SOC 2 Type II attestation (Security, Confidentiality, Availability) and says it holds an ISO/IEC 27001:2022 certificate in its Trust Center. The reports themselves may require sign-in, so ask for them if a contract depends on it.
- The ClickFunnels patent case is over at the appeals level. On July 2, 2026 the Federal Circuit affirmed dismissal because the patents were invalid under Section 101. The ruling did not decide whether HighLevel infringes.
- Most 'scam' complaints trace to three things: income-claim marketing around reselling GoHighLevel, usage charges on top of the plan price, and text or email campaigns that carriers or inbox providers block. None of them mean the company is fake.
- A safe platform does not make a safe setup. Your risk sits in who holds admin access, what data you load, and who sold you the account.
Yes. GoHighLevel is a legitimate product from a real, US-based software company, HighLevel Inc., which was founded in 2018 and is headquartered in Dallas, Texas. The searches for “scam” and “lawsuit” have specific causes that have little to do with whether the company exists or whether the software works. This page separates the company facts from the complaint patterns, so you can decide what is actually worth worrying about.
Checked on October 15, 2026 against HighLevel’s own pages, a General Atlantic press release and the Federal Circuit opinion. This page is not legal or financial advice.
Who owns GoHighLevel and where is it based?
HighLevel Inc. owns and sells GoHighLevel. It is based in Dallas, Texas. The legal entity names vary by page: the April 2024 press release says HighLevel Inc., and the footer of HighLevel’s certifications page reads “HighLevel LLC, a subsidiary of GoHighLevel Inc.” If a contract needs the exact legal name, read the Terms of Service attached to your account.
| Question | What the primary sources say | Source |
|---|---|---|
| Founded | 2018 | General Atlantic press release, April 11, 2024 |
| Founders | Shaun Clark (CEO), Varun Vairavan (CTO), Robin Alex (COO), described as co-founders and largest shareholders | Same release |
| Outside investor | General Atlantic, a minority growth investment; two General Atlantic partners joined the board; PeakEquity Partners remained a shareholder | Same release |
| Headquarters | Dallas, Texas | HighLevel certifications page footer |
| Hosting | Product infrastructure resides in the United States on Google Cloud Platform and Amazon Web Services | HighLevel Security and Compliance Overview |
| Scale, company-reported | “Over 2 million businesses worldwide” (October 31, 2025 release); 118K+ community members and 800+ Certified Admins (Academy page) | Press release and Academy page |
Is GoHighLevel a public company?
We found no public listing in the sources checked. HighLevel announced a minority growth investment from General Atlantic, a private growth-equity firm, on April 11, 2024, and describes its co-founders as the largest shareholders. That is how a privately held company is described. If your purchase depends on public financial filings, search SEC EDGAR for “HighLevel” yourself, because we did not open EDGAR for this page.
How many users does GoHighLevel have?
There is no current official paying-account count on the pages we checked. Two company-reported figures exist. A press release dated October 31, 2025 says HighLevel “now supports over 2 million businesses worldwide.” The Academy page shows 118K+ members in its community and 800+ Certified Admins. “Businesses supported” includes the clients of agencies that resell the platform, so it is larger than the number of accounts that pay HighLevel directly.
Is GoHighLevel safe and secure?
Judged by what HighLevel publishes, yes, at the platform level. Three documents support that, and each one is worth opening before you sign anything that depends on it.
| Claim | What HighLevel says | Where to check |
|---|---|---|
| SOC 2 Type II | “Accredited on Security, Confidentiality, and Availability.” The help-center announcement says the information security program started in April 2025 and was audit-ready by the end of that year. The page shows no publication date. | help.gohighlevel.com, “HighLevel Achieves SOC 2 Type II Certification” |
| Annual audits | “HighLevel undergoes annual SOC 2 Type II assessments.” | gohighlevel.com/privacy-and-security |
| ISO/IEC 27001:2022 | The Trust Center lists an ISO/IEC 27001:2022 certificate, the SOC 2 attestation report and the Information Security Program. “Some items may require sign-in to view.” | Security and Compliance Overview, Contact section |
| Encryption | TLS 1.2 or 1.3 in transit, AES-256 at rest, keys rotated in a hardened key-management system | Security and Compliance Overview |
| Access controls | Two-factor authentication enforcement, granular user permissions, audit logs, SSO | Privacy and Security page |
| Employee access | Support access to a customer portal is time-limited (maximum 24 hours per request), logged, and blocked from high-risk actions such as exporting contacts or deleting contacts | Security and Compliance Overview |
| Testing | Regular third-party penetration testing, a responsible disclosure program, automated vulnerability scanning | Privacy and Security page |
| Privacy law | Says it complies with GDPR, CCPA and CAN-SPAM, and holds EU-U.S. Data Privacy Framework certification | Privacy and Security page |
Two cautions keep this honest. First, a SOC 2 report describes HighLevel’s controls, not your account. A sub-account with a shared password, no two-factor authentication and every employee set as admin is not made safe by an audit of HighLevel. Second, HighLevel’s own help article says the product “should not be used to collect or store sensitive information, such as credit or debit card numbers, financial account information, Social Security numbers, passport numbers, financial or health information except as otherwise permitted.” For health data, that exception is the paid HIPAA package. See Is GoHighLevel HIPAA compliant? and, for EU or UK contacts, Is GoHighLevel GDPR compliant?.
The hosting detail differs slightly between pages. The Privacy and Security page lists Google Cloud Platform, while the security overview names Google Cloud Platform and Amazon Web Services. Ask HighLevel which applies if hosting location matters to your contract.
Is there a GoHighLevel lawsuit?
Yes, one we verified at the court level: Etison LLC, d/b/a ClickFunnels v. HighLevel, Inc., a patent case. ClickFunnels is a competing funnel-builder. It lost, and the loss was upheld on appeal.
| Detail | What the court record shows |
|---|---|
| Appeals court | U.S. Court of Appeals for the Federal Circuit, No. 2025-1711 |
| Decided | July 2, 2026 |
| Lower court | District of Delaware, No. 1:24-cv-00502-JCB, Judge Campbell J. Barker |
| Panel | Judges Lourie, Cunningham and Stark; Judge Stark wrote the opinion |
| Patents | U.S. Patent Nos. 10,846,357 and 11,361,047, titled “Website Creation System for Creating Websites Having At Least One Series of Directional Webpages and Related Methods” |
| What the district court did | Dismissed the infringement suit for failure to state a claim, holding all asserted claims invalid under Section 101 of the Patent Act |
| What the Federal Circuit held | The district court erred by treating one claim as representative of all challenged claims. All the claims are nevertheless invalid, so the error was harmless |
| Outcome | “AFFIRMED” |
| Precedent status | The disposition is marked nonprecedential |
In plain terms: ClickFunnels claimed HighLevel infringed its funnel-building patents. The courts found the patents themselves were not valid, because they claim an abstract idea. The ruling is about whether ClickFunnels could own those patents, not about whether HighLevel’s software works, handles data properly or treats customers fairly. It also does not say anything about other cases. We did not run a full docket search on CourtListener or PACER, so check both before a high-value contract. For the product-level differences between the two platforms, see GoHighLevel vs ClickFunnels.
Why do people search “is GoHighLevel a scam”?
Because the money-making pitch around GoHighLevel is loud, and several real problems look like fraud from the outside. These are the patterns, stated as patterns. They are not allegations against any company. For what customers actually say on Trustpilot, Software Advice and GetApp, and which complaints repeat, see our GoHighLevel reviews analysis.
| Pattern | What actually happens | What to do |
|---|---|---|
| Reseller and “agency in a box” courses | HighLevel’s Academy page says it pays affiliates 40% monthly recurring commissions and $150M+ so far. Many reviews of the product are written by affiliates, so a positive review may be paid and a negative one may come from someone whose course did not deliver income. | Read affiliate reviews as sales material. Look for the disclosure. Test the product on a trial. See the affiliate and reseller guide. |
| Billing surprise | The plan price is not the whole bill. SMS, calls, email, AI and phone numbers are usage charges, and some features are add-ons. | Read GoHighLevel hidden costs before you commit and set wallet limits. |
| A2P rejection | US carriers require registration for business texting. Rejections and delays are common and can look like the platform is blocking you. | See why A2P 10DLC registrations get rejected. |
| Spam complaints | Users who send cold texts or cold email through the platform can get blocked or suspended, and then blame the tool. | Read can you send cold emails with GoHighLevel and why email sending was suspended. |
| A text from “LeadConnector” | Recipients see an unfamiliar brand name and assume phishing. LeadConnector is HighLevel’s own infrastructure name. | See what LeadConnector is. |
| Cancelling | Some users find the cancellation and refund rules after they sign up. | Read how to cancel and get a refund first. |
This pattern list is an editorial reading of how the complaints arise, not a count of complaints. We did not use review-site scores for this page.
How do you vet GoHighLevel, or anyone selling it?
Run both checklists. The first checks the vendor. The second checks the person who is selling you the platform or building your account.
Vendor checklist (about 15 minutes):
- Open the status page and look at the incident history. See Is GoHighLevel down?.
- Open HighLevel’s Privacy and Security page and its Security and Compliance Overview, and ask for the SOC 2 report under NDA if your client or your regulator needs it.
- Read the Terms of Service for data ownership, export and cancellation.
- Start the trial and export a contact list on day one. If you cannot get your data out, you will find out cheaply. See how to export contacts from GoHighLevel.
- Price the usage you actually expect, not the plan. Use the pricing calculator.
Seller or builder checklist:
- Who owns the account? The account, billing and admin ownership must be yours. If the seller keeps the agency account and puts your business in a sub-account, you are renting access to their account.
- Can you see the invoice? You should see what HighLevel charges and what the seller marks up.
- Is there a written scope and price? Be wary of any seller who guarantees income, rankings or lead volume.
- Who handles A2P and email authentication? These are the two things that break messaging. Ask who registers the brand and campaign and who sets up SPF, DKIM and DMARC.
- What happens if they disappear? Ask for admin credentials, documentation and a snapshot of the build.
- Can they show a working account? Ask for a live walkthrough of a comparable build, not screenshots.
How to choose a GoHighLevel agency goes deeper on the seller side, and GoHighLevel expert vs agency vs freelancer compares the three kinds of builder. If you want a second opinion on a quote or an existing build, aibrevo’s GoHighLevel service page explains what a review and build covers.
Sources
All checked on 2026-10-15.
- HighLevel, Security and Compliance Overview: founded 2018, US-resident infrastructure, GCP and AWS, encryption, employee access limits, data classification, Trust Center and ISO/IEC 27001:2022 listing.
- HighLevel, HighLevel Achieves SOC 2 Type II Certification: accredited on Security, Confidentiality and Availability; program started April 2025. The page shows no publication date.
- HighLevel, Data Privacy and Security: annual SOC 2 Type II assessments, EU-U.S. Data Privacy Framework, GDPR, CCPA and CAN-SPAM statements, security controls.
- General Atlantic, HighLevel Announces Minority Growth Investment from General Atlantic, April 11, 2024: founded 2018, founders and roles, board seats, PeakEquity Partners.
- HighLevel, Certifications page: Dallas, Texas corporate headquarters and the “HighLevel LLC, a subsidiary of GoHighLevel Inc.” footer.
- HighLevel, Academy page: 118K+ community members, 800+ Certified Admins, 40% recurring affiliate commission, $150M+ paid to affiliates.
- ACCESS Newswire, HighLevel Named One of LinkedIn’s 2025 Top Startups in Dallas, October 31, 2025: “over 2 million businesses worldwide.”
- U.S. Court of Appeals for the Federal Circuit, Etison LLC v. HighLevel, Inc., No. 2025-1711 (July 2, 2026): caption, panel, district court, patents, holding, disposition and nonprecedential status.
- IPWatchdog, Federal Circuit Finds Representative Claim Error Harmless, Affirms Section 101 Dismissal, July 6, 2026: secondary confirmation of the holding.
- HighLevel, status page: public incident history.