Security & Trust Center
Platform Security Commitments
Learn how VAPT Insights protects your codebase, isolates scan telemetry, and manages infrastructure compliance.
Last updated · June 7, 2026
We don't sell your data
Never have, never will. Your team's codebase telemetry, scan reports, and configurations are not products. We will never sell your information to third parties.
We collect very little
Only the essentials: email, name, account profile details, subscription logs, project names, and vulnerability tracking metrics. That's the full list. For our free in-browser tools, zero files ever leave your local browser memory.
Your workspace is siloed
Row-level security (RLS) is strictly enforced at our database layer. Each team operates in its own isolated workspace, and no organization can ever view another's scan history or credentials.
Passwords are never plaintext
All user authentication and credentials management are handled securely by Supabase Auth utilizing industry-standard hashing algorithms. We never see or store your password.
An honest compliance statement
We're a small, dedicated team and are not fully SOC 2 certified yet. However, we host our frontend and database on Vercel and Supabase, and our scanning backend is hosted on DigitalOcean (built on top of AWS) – all of which maintain full, verified SOC 2 Type II compliance audits.
You can purge data anytime
You have complete control. You can trigger deletion directly from your settings dashboard, or email us at [email protected] to request full account and record purges.
What We Collect
We collect only what the product needs to function. Nothing more.
| Data Category | What We Collect / Inspect | Purpose & Functionality |
|---|---|---|
| User Information & Profile | Full name, email address, avatar URL, job role, company size, and billing log history. | Necessary to manage platform access, isolate workspace permissions, and handle billing details securely. |
| SBOM & Dependency Ingestion | Package names, library versions, and licenses from dependency manifests (CycloneDX / SPDX). | We never read or scan your proprietary source code files. This manifest is received via CI/CD integrations to audit nested security CVEs, regardless of what your project is about. |
| Public Data Scans | Public internet-facing server configurations, SSL/TLS certificates, and response headers. | Our scanners inspect only public perimeter configurations visible to any standard browser on the open internet to rate header/SSL hygiene. |
| Domain DNS Verification | Public DNS TXT validation record strings. | To prevent unauthorized security scanning of third-party domains, we require you to verify ownership by adding a custom TXT validation key to your DNS registrar before scanning is unlocked. |
| Analytics & Page Views | Aggregate page views, click interactions, and navigation route patterns. | Google Analytics and Vercel Analytics measure page views and catalogued public-site interactions. Analytics consent is denied by default; accepting enables full measurement, and event parameters exclude credentials, form contents, scan targets, and account identifiers. |
What We Don't Do
Our clear boundaries and platform safety limits.
| Activity | Our Policy & Implementation |
|---|---|
| Read or Store Source Code | We only digest compiled dependency manifest metadata (like SBOM CycloneDX/SPDX JSON files). Your raw intellectual property, codebase files, and logic structures never touch or leave our servers. |
| Sell Your Information | Your email, names, project names, and vulnerability tracking metrics are never sold, rented, or distributed to third-party data aggregators or advertisers. |
| Run Unauthorized Scans | Active perimeter checkers are locked down until domain ownership is validated via custom DNS TXT records. We never perform active scans of third-party assets. |
| Store Plaintext Credentials | All authentication functions are handled securely by Supabase Auth utilizing strong, standard bcrypt hashing algorithms. Raw passwords are never visible to us. |
| Share Reports Publicly | Telemetry metrics are protected by Row-Level Security (RLS) policies at the database layer. No user or company can ever access or view another team's scan results. |
Infrastructure & Security
Our active security protocols and hosting infrastructure.
| Security Control | Implementation & Specifications |
|---|---|
| Cloud Hosting Stack | Our frontend application is hosted on Vercel's global edge network, user databases operate on Supabase, and the scanning backend runs on dedicated DigitalOcean nodes deployed on top of AWS virtualization. |
| Data Encryption Standards | All telemetry databases and credentials are encrypted at rest using Advanced Encryption Standard (AES-256). All communications and API calls are secured via TLS 1.3/HTTPS tunnels in transit. |
| Data Center Security | All host servers, physical datacenters, and cloud network operations used possess verified SOC 2 Type II compliance audits, 24/7 logging, and redundant database scaling. |
| Network Threat Hardening | Hardened using strict Content Security Policy (CSP) headers blocking dynamic evaluations in production, user-level server rate limiting, and SSRF validators blocking private subnet scans. |
| Email Security & Services | All transaction and authentication email deliveries are handled through Zoho Mail and Resend services. All official platform communications originate exclusively from `@vaptinsights.com` domains. |
Compliance & Certification
Our current audit statuses and framework mappings.
| Framework / Audit | Current Compliance Status |
|---|---|
| SOC 2 Type II | Not yet SOC 2 certified. We are a small, transparent team; while we do not hold a direct SOC 2 compliance certificate yet, all underlying hosting resources (Vercel, Supabase, and AWS datacenters) maintain active SOC 2 audits. |
| GDPR & Data Privacy | Compliant. Strict Row-Level Security permissions are enforced. Telemetry metrics processed via free analysis modules are processed client-side in browser memory only and never stored in any database. |
| OWASP Top 10 Standards | Compliant. The platform codebase is regularly scanned and hardened against standard web vulnerabilities, employing secure rate-limits, Content Security Policies, and input sanitation. |
Data Deletion & Retention
We will acknowledge your request within 5 business days and complete deletion within 30 days. Some data may be retained in anonymized or aggregated form for product improvement purposes only.
| Policy / Action | Implementation & Specifications |
|---|---|
| Request Data Deletion | You can request manual data deletion at any time. Email us at [email protected] and our engineering team will handle and confirm your request promptly. |
| User Account Purging | Triggering account deletion from your settings dashboard will immediately queue all profile database rows, configurations, integration channels, and billing associations to be permanently purged. |
| Scan Telemetry Retention | Historical scan telemetry and dependency reports are retained in order to compile vulnerability trends inside your dashboard. These logs are permanently deleted when you archive a project or close your account. |
| In-Browser (Free) Tools | Uploaded CycloneDX/SPDX SBOM files and local configurations processed via our free online tools are loaded strictly in browser memory. We retain zero logs, files, or information from these operations. |
Contact
Questions about security, data handling, or this page? Reach us at [email protected]. We respond to all security and privacy inquiries personally.
System Status & Availability
Uptime history for the past 90 days across core service functions.