Security

Architecture

• Tenant isolation: Every request is scoped to your organisation by explicit organisation filters in our application code, enforced by an automated cross-tenant test that fails the build if a query loses its filter. Postgres row-level security is enabled on every tenant table as a second line of defence against direct database access.
• Authentication: Clerk Pro. On the Enterprise plan, SCIM provisioning is self-serve, and our team connects SAML single sign-on to your identity provider on request.
• Organisation identity comes only from the verified sign-in session, resolved on the server; it is never taken from anything the browser sends.
• Audit logs: append-only; only writable by the service role.
• Storage: per-organisation paths (/orgs/{org_id}/...), private buckets, 30-minute signed URLs.

Operational controls

• HSTS, X-Frame-Options DENY, no-sniff content-type headers enforced site-wide.
• All secrets in environment variables; no secrets in repository.
• Sentry error monitoring, with personal data masked. PostHog product analytics, only after the visitor consents: anonymous page views and product events, with no person profiles and no screen content.
• Health endpoint at /api/health for uptime monitors.

Compliance roadmap

SOC 2 and ISO 27001 — readiness work is underway; no report or certificate has been issued, and none is claimed until it is. GDPR data export, erasure and subject-access endpoints — live in-product.

Contact

Report a vulnerability to care@vouliiq.com. We acknowledge every report within 1 business day.