Security
Security is a product requirement here, not a policy page. This is what we do, plainly stated - including the parts still in progress.
Last updated: 25 July 2026
Tenant isolation
Multi-tenancy is enforced in code, not by convention. The business a request belongs to is resolved from a verified token and cross-checked against an active team membership; it is never taken from a client-supplied parameter. Every database query passes through a tenant-scoped layer, and the vector store keeps each business's embeddings in its own collection.
Encryption
- TLS 1.2+ for all traffic, HSTS enabled on our domains.
- Encryption at rest for databases, object storage and backups.
- Channel tokens and third-party credentials encrypted with managed keys, never logged.
Access control
- Role-based permissions (owner, admin, agent, viewer) enforced by a single capability matrix on the server.
- Least-privilege internal access, reviewed periodically; production access is logged.
- Password hashing with a modern memory-hard algorithm; session tokens are short-lived.
Answer safety
The retrieval pipeline refuses to answer when grounding confidence is below threshold, so the agent escalates rather than inventing a policy. Every answer records the source chunks it used, which makes replies auditable after the fact - the same mechanism that protects your customers protects you.
Availability and recovery
- Automated daily backups with periodic restore tests.
- Health checks and structured logging with alerting on error-rate and latency budgets.
- Rate limiting and abuse detection on public endpoints.
Development practices
- Code review on every change and dependency vulnerability scanning in CI.
- Separate development, staging and production environments with no production data in lower environments.
- Secrets held in a managed secret store, never in source control.
In progress
We are working towards SOC 2 Type II and ISO 27001 readiness, single sign-on for Enterprise, and customer-managed data retention windows. We would rather list these honestly than imply certifications we do not yet hold.
Reporting a vulnerability
Email hello@vaaniapi.com with steps to reproduce. We acknowledge within 2 business days, keep you updated, and will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service degradation.