Security at Vysiro
We build a domain trust platform — so we hold ourselves to the same rigorous standards we measure in others. Here is how we protect your data, our infrastructure, and your trust.
Security Practices
The controls that protect every scan, every API call, and every byte of customer data.
Encryption Everywhere
Data encrypted in transit (TLS 1.3) and at rest. All connections enforce modern cipher suites with forward secrecy.
Multi-Tenant Isolation
Multi-tenant isolation with per-tenant Firestore paths. Every read and write is scoped to the authenticated tenant.
Rate-Limited Endpoints
All API endpoints rate-limited. Public scan endpoints enforce per-IP throttling; authenticated endpoints enforce per-key limits.
No Plaintext Credentials
No plaintext credential storage. API keys are SHA-256 hashed before persistence; the plaintext value is returned exactly once at creation.
Source Maps Disabled
Source maps disabled in production. Client bundles are minified and obfuscated to prevent reverse-engineering of business logic.
Security Headers
Comprehensive security headers enforced on every response: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
Responsible Disclosure
We value the work of security researchers and welcome responsible vulnerability reports.
Report a Vulnerability
Found a vulnerability? Email security@vysiro.com with a detailed description, reproduction steps, and any proof-of-concept code.
Response SLA
We acknowledge reports within 48 hours. Critical vulnerabilities are triaged immediately and we aim to resolve them within 7 days.
No Legal Action
We do not pursue legal action against good-faith researchers who follow responsible disclosure practices.
Safe Harbor
Activities conducted in a manner consistent with this policy will be considered authorized conduct. We will not initiate legal action against you if you act in good faith, avoid privacy violations, do not disrupt our services, and report findings promptly to security@vysiro.com. If legal action is initiated by a third party against you for activities conducted under this policy, we will take steps to make it known that your actions were authorized.
Compliance
Our compliance posture across key regulatory frameworks.
SOC 2
PlannedSOC 2 certification is planned. Our proof packs already generate audit-ready evidence mapped to SOC 2 controls; we will pursue formal certification as we scale.
PCI DSS 4.0
SAQ-A CompliantPCI DSS 4.0 SAQ-A compliant. All payment processing is delegated to Stripe (PCI Level 1); no cardholder data touches Vysiro servers.
GDPR
AlignedData processing practices aligned to GDPR for EU users. Data Processing Agreements are available for all customers upon request.
NIS2
AlignedNIS2 aligned. Security controls and incident response processes are mapped to the EU NIS2 Directive requirements.
Infrastructure
The production stack that powers Vysiro.
Hosted on Vercel
Production workloads run on Vercel's global edge network with automatic failover, DDoS protection, and zero-downtime deployments.
Firebase Auth + Firestore
Authentication via Firebase Auth (email, Google, GitHub, Apple). Data persistence in Firestore with automatic replication and encryption at rest.
Stripe PCI Level 1
All payment processing handled by Stripe, a PCI Level 1 certified service provider. No cardholder data is stored, processed, or transmitted by Vysiro.