Security

How we protect your data

- Connections to the Service are encrypted, and HTTPS is enforced.

- Passwords are stored hashed, never as plain text.

- Sign-in and other sensitive actions are rate limited.

- Staff access is role-based, and administrator actions are recorded in an audit log.

- Downloads and data exports use signed links that expire.

- Card details are handled by our payment processor. We never see or store full card numbers.

- Browser protections such as framing and content-sniffing limits on every page.

Our providers and where they operate are on the sub-processor page. No system is perfectly secure. See our Privacy Policy for what happens if there is a breach.

Report a vulnerability

If you find a security problem, email security@visolab.io. Please include what you found, the steps to reproduce it, and how to reach you. Our contact details are also in security.txt.

We acknowledge reports promptly and keep you updated.

Rules for testing

- Test only your own account. Don't access, change or delete other people's data.

- Don't run denial-of-service tests, spam, or social-engineering attacks on our staff or users.

- Tell us before sharing the problem publicly, and give us reasonable time to fix it.

- Don't test our providers' systems; report problems with them to the provider.

If you follow these rules and act in good faith, we won't take legal action against you for your research. This doesn't bind other parties, such as our providers, or allow anything the law forbids.