Security at Vylot

Your business data is sensitive. Here's how we protect it at every layer.

Security Practices

Data Encryption

All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Database connections are never exposed to the public internet.

Cloudflare Infrastructure

Vylot runs on Cloudflare Workers and D1 — one of the most secure and DDoS-protected global network infrastructures available.

Zero-Trust Authentication

Every API request is authenticated via Firebase Auth JWTs. Tokens are short-lived and validated server-side on every request.

Data Isolation

Every business's data is logically isolated by business_id enforced at the database query level. No cross-tenant data leakage is architecturally possible.

API Key Security

API keys are stored as SHA-256 hashes. The plaintext key is only shown once at creation. Keys can be rotated or revoked at any time.

Webhook Signature Verification

All webhook deliveries are signed with a SHA-256 HMAC using your endpoint's unique secret, so you can verify every payload's authenticity.

Compliance

GDPR
We process personal data lawfully and provide data export and deletion mechanisms.
Compliant
IT Act 2000 (India)
Vylot operates in compliance with Indian information technology laws.
Compliant
GST Data Standards
Invoice data follows GSTN specifications for GSTR-1 JSON generation.
Compliant
PCI-DSS
We do not store card data. Payments are processed via PhonePe's certified gateway.
N/A — Delegated

Related Policies & Contacts

Responsible Disclosure

Found a vulnerability? We take security reports seriously.

Data Processing Agreement

For enterprise customers requiring a formal DPA.

Privacy Policy

How we collect, use, and protect your personal data.

Cookie Policy

What cookies we use and why.

Found a vulnerability?

We take security issues seriously. Please report them responsibly to our security team.

Report Vulnerability