TLS 1.3 everywhere, HSTS preloaded
Every request to Vimub goes over TLS 1.3 with HSTS and a two-year preload. No plaintext HTTP is accepted anywhere in production.
SecurityYour customer list is the most
Your customer list is the most
valuable thing in your shop. We treat it that way.
Vimub handles reviews, customer contact details, and booking history for 2,400+ locations. Here is how we protect that — concretely.
For a signed security questionnaire, DPA, or sub-processor list, email support@vimub.com.
AES-256-GCM for all customer data
Supabase Postgres volumes encrypt at rest with AES-256. Sensitive fields (API keys, OAuth tokens, brand-voice profiles) are wrapped with a second envelope in lib/security/encryption.ts before they hit the database.
Row-level security on every table
Every tenant-scoped table has row-level security policies enforced at the database layer, not the app — a request from Org A can never read or write a row belonging to Org B.
No service-role keys in the browser
Public-facing code uses an anon key only. The service-role key lives in server-only routes and the MCP server. We audit this on every pull request via a custom ESLint rule.
Non-root containers and network policies
The Python MCP server runs as an unprivileged appuser in a read-only filesystem container. Railway network policies limit egress to Anthropic and Twilio only.
Structured logs with PII redaction
Every API call logs an event with user, org, route, and outcome. PII (emails, phone numbers, customer names) is redacted before logs leave the boundary. Retention: 90 days.
Named on-call. 24-hour disclosure.
One of the three founders is on call at all times. If a confirmed breach affects your data, you hear from us within 24 hours — always by email from a named human, not a support queue.
Penetration testing — planned, firm not yet appointed
We're building toward a quarterly black-box penetration test by an external firm as part of our SOC 2 program. No firm is appointed and no test has been conducted yet — see /trust for live status.
Compliance
Built with UK GDPR, CCPA, and SOC 2 in mind.
- UK GDPR / EU GDPR: Data Processing Agreement available at /legal/dpa. Sub-processor list at /legal/subprocessors.
- CCPA / CPRA: Supported via the privacy policy. Data deletion is one click in Settings → Account.
- SOC 2 Type II: In preparation — the audit firm has not yet been appointed. Live control-by-control status at /trust.
- ISO 27001: Our internal controls map to Annex A; formal certification is not yet scheduled.
- PCI DSS: We never see card data — Stripe handles all payment flows. PCI SAQ A applies.
Responsible disclosure
Found a bug? Tell us privately first.
We operate a responsible disclosure policy and pay bounties for qualifying vulnerabilities. Please email support@vimub.com with details. We acknowledge within 24 hours.