Security, stated precisely

Hosting and location

Vercel server functions are pinned to the Frankfurt region through fra1. The production database standard is an EU region and must be verified in the database-provider console before launch and after migrations. Vercel, Google, Stripe, email providers, AWS, and other vendors can operate global support, delivery, security, or control-plane services. Our sub-processor register states those boundaries. We therefore describe EU-region primary hosting, rather than promising that every item of service metadata always remains inside the EU.

Authentication and sessions

Veillo uses Better Auth with email and password or optional Google sign-in. Passwords are stored as hashes by the authentication library. Production sessions use HTTP-only, Secure, SameSite cookies and expire after 30 days. Password-reset and OAuth flows use expiring verification records. Staff access requires a verified email on a restricted domain or explicit allowlist.

Tenant and role controls

Application queries scope customer records to an organisation membership. Roles control editing, review, administration, and audit access. Platform staff identities are separate from customer membership and do not receive authority to confirm a customer’s classification or sign a customer document. This application-level isolation is not described as database row-level security, because the current schema does not implement PostgreSQL RLS.

Encryption and secrets

Traffic uses HTTPS in production. Google connector refresh tokens are encrypted with a deployment secret before database storage. Production secrets belong in Vercel environment variables and are excluded from source control. Payment card details are collected by Stripe, not stored by Veillo. Database-at-rest encryption and backup controls are provided by the selected production database service and must be verified in that account.

Application and browser protections

Responses set a Content Security Policy, clickjacking protection, MIME sniffing protection, a strict referrer policy, a permissions policy, cross-origin opener isolation, and HTTP Strict Transport Security. Google Analytics is the only allowed third-party browser script and remains blocked until consent. JSON-LD is escaped before insertion. Server routes repeat authorisation checks and do not rely on the request proxy as the only access gate.

Audit records

Material product actions create separate audit rows with actor, time, entity, action, and summary data. The application does not expose an edit function for those rows. The database does not yet enforce an immutable write-only table, so we call this an application audit record rather than making an absolute cryptographic or append-only claim.

Backups, monitoring, and incident response

Database backup retention, point-in-time recovery, application log retention, alerting, and incident contacts are deployment controls. They must be enabled and recorded in the production runbook before customer launch. A security incident affecting personal data is handled under the incident procedure and the notification duties in the DPA. We do not claim a certification, penetration-test result, uptime percentage, or recovery objective that has not been independently completed and recorded.

Responsible disclosure

If you believe you found a vulnerability, read our responsible disclosure policy and email security@veillo.eu. Please avoid customer data, service disruption, social engineering, and public disclosure before we have had a reasonable chance to respond.

Legal and privacy documents

See the privacy policy, Data Processing Agreement, cookie policy, and sub-processor register.

Operator

Veillo is an Arbos Techne product, operated by Arbos Folk, a sole proprietorship registered in Denmark. You can reach us at hello@veillo.eu.