Security Policy

Last updated 2026-10-14

What we do to keep your account and your work safe, and what we ask of you.

Infrastructure

• All data is stored in the European Union (AWS eu‑west‑1, Ireland) on Supabase‑managed Postgres and object storage, encrypted at rest with AES‑256.
• All traffic between you, our servers and our providers uses TLS 1.2 or higher. Plain HTTP is redirected.
• Database access is enforced with row‑level security: every query runs as the signed‑in user and can only reach that user's rows. There is no shared “admin” path in the client.
• Daily encrypted backups, retained 30 days, tested by restore.

Accounts and sessions

• Passwords are hashed with bcrypt; we never store or log them in clear text. Sign‑in via OAuth providers uses standard OIDC flows.
• Every sign‑in creates a device session you can see and revoke in Settings → Devices. Revoking a session signs that device out immediately.
• Accounts under protection have access logging enabled: every read of their data is recorded with time, actor and origin, and retained 12 months.

Model providers and keys

• Provider API keys live only in server‑side environment configuration, never in the browser or the repository.
• Requests to providers carry only what the request needs: the prompt, the attachments you included and the conversation context. Never your e‑mail, payment data or other users' content.
• We use provider API terms that exclude training on your data.

Payments

Card data is entered directly into Stripe's PCI‑DSS Level 1 environment. Vyndexo stores only a Stripe customer identifier and the last four digits for display.

Incident response

If we discover a personal‑data breach that is likely to put you at risk, we notify the Belgian Data Protection Authority within 72 hours and affected users without undue delay, describing what happened, what data was involved and what we did about it.

Responsible disclosure

Found a vulnerability? E‑mail support@vyndexo.com with the subject Security. Give us enough detail to reproduce it. We acknowledge within 3 business days, keep you updated, and credit you if you want. We will not pursue legal action against researchers who follow these rules: do not access data that is not yours, do not disrupt the service, and give us a reasonable time to fix the issue before publishing. Automated scanning and social engineering of our users are out of scope.

What we ask of you

• Use a unique password or an OAuth sign‑in.
• Review Settings → Devices if you shared a computer.
• Do not paste secrets or other people's personal data into prompts you intend to share.