Security at Vylot
Your business data is sensitive. Here's how we protect it at every layer.
Security Practices
Data Encryption
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Database connections are never exposed to the public internet.
Cloudflare Infrastructure
Vylot runs on Cloudflare Workers and D1 — one of the most secure and DDoS-protected global network infrastructures available.
Zero-Trust Authentication
Every API request is authenticated via Firebase Auth JWTs. Tokens are short-lived and validated server-side on every request.
Data Isolation
Every business's data is logically isolated by business_id enforced at the database query level. No cross-tenant data leakage is architecturally possible.
API Key Security
API keys are stored as SHA-256 hashes. The plaintext key is only shown once at creation. Keys can be rotated or revoked at any time.
Webhook Signature Verification
All webhook deliveries are signed with a SHA-256 HMAC using your endpoint's unique secret, so you can verify every payload's authenticity.
Compliance
Related Policies & Contacts
Found a vulnerability? We take security reports seriously.
For enterprise customers requiring a formal DPA.
How we collect, use, and protect your personal data.
What cookies we use and why.
Found a vulnerability?
We take security issues seriously. Please report them responsibly to our security team.