Security

Last updated 1 September 2026

What we actually do, stated plainly enough that you can hold us to it. Nothing on this page is aspirational — if it is written here, it is in the code today.

In transit

Every connection is TLS. Plain HTTP is redirected to HTTPS before anything is served, and a Strict-Transport-Security header with a one-year lifetime tells the browser not to try HTTP again. Requests to the AI provider and the payment provider are equally encrypted.

At rest

Passwords are stored only as bcrypt hashes. They are never written in readable form, never logged, and cannot be recovered by us — a reset creates a new one rather than revealing the old.

The sensitive company fields — your tax number, customs number, national number, bank identifiers, phone and registered address — are encrypted with AES-256-GCM before they reach the database. Someone who obtained a copy of the database alone would not be able to read them.

Card numbers are never in our system at all. The card form belongs to our payment provider; we hold a token, the last four digits and whether the charge worked.

Sessions and access

Sessions are server-side tokens that expire on their own and can be revoked at any time by signing out or changing your password — which signs out every other device. Session and form-token cookies are Secure, HttpOnly and SameSite=Lax, so they travel only over HTTPS and cannot be read by page scripts. Login attempts are rate-limited to slow credential guessing, and requests are rate-limited per address to keep automated abuse from becoming an outage or a bill.

Every record is scoped to the organisation that owns it and that scope is enforced in the query, not in the interface — one account cannot read another's data by changing an id in a URL. Administrative access is limited to a single named account, is not discoverable by ordinary users, and is not used to read customer content in the course of ordinary support.

The application itself

Every response carries a Content Security Policy restricting where scripts, styles, frames and connections may come from, plus X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Database access is entirely through prepared statements. Every form carries a CSRF token. Output is escaped at the point of rendering. Source files, configuration, database dumps and archives are blocked from being served at the web-server level as well as by not being linked — a rule that exists because a source archive was once found sitting in the web root during a routine pre-deploy check, and removing it was not considered a sufficient fix on its own.

Destructive administrative actions are two-step by design: a preview that shows exactly what would be affected, then a second, explicitly confirmed call. There is no single-click destructive action anywhere in the administrative interface, and statutory records such as tax invoices are never hard-deleted — they are unlinked instead.

Backups

The database is backed up on a schedule, and the backup location is not web-readable. Backups roll off on their own cycle and are never restored to bring back an account that has been deleted.

Reporting a vulnerability

Please tell us before you tell anyone else: support@veloque.in, or see /.well-known/security.txt. A security report is treated as Critical from the moment it arrives — a person replies the same business day, and it goes straight to owner level rather than waiting out a queue. See the escalation policy for what happens next. We will not threaten a researcher who reports in good faith and gives us a reasonable chance to fix it.

What we do not claim

We do not hold ISO 27001 or a SOC 2 report, and we will not imply otherwise to win a procurement review. We are a small company; what we offer instead is this page, a straight answer to a security questionnaire, and the Data Processing Addendum in force on every account without asking. If your process genuinely requires a certification, tell us and we will say honestly whether and when we could get there rather than let you assume.

Sub-processors

Everyone who touches data on our behalf, what they do, and where they are. This is the canonical list — the privacy policy and clause 6 of the Data Processing Addendum both point here rather than repeating it, so it cannot quietly fall out of date in one place and not the other.

Before we add or replace one, we publish the change here and email the admin contact on every account at least 30 days beforehand, so you have time to object. Clause 6 of the Addendum sets out what happens if you do.

Nobody else. We use no advertising network, no data broker, no session-replay or heatmap tool, no third-party chat widget, no CRM that ingests your records, and no analytics beyond the one listed above. If that changes, it changes here first.

This page goes with our Privacy policy, Data Processing Addendum and Cookie policy. Security contact: support@veloque.in.