Security | VextronAI

This page explains how VextronAI protects the data agencies keep in it, and how to tell us about a security issue.

Where data is hosted and processed

Main database: in London (UK), with Supabase.
Stored files and connected-account tokens: in the EU, with Cloudflare.
Our off-site backup: in the EU.
AI requests: processed by Anthropic, anywhere in the world, including in the USA.

Our sub-processors page lists every service that processes agency data, what it handles, and where.

Encryption

In transit: connections to VextronAI and between our services use HTTPS (TLS).
At rest: our database provider encrypts all data at rest (AES-256), and our file storage encrypts every stored file.
Our own layer: we encrypt the Google and Microsoft access tokens for connected mailboxes ourselves (AES-GCM, 256-bit) before they’re stored, and decrypt them only in memory when they’re used.
Sign-in secrets: authenticator-app keys are stored encrypted, and recovery codes are stored only as one-way hashes.

Keeping each agency’s data apart

Each agency’s data is isolated at the database level. Agency data is protected by row-level security, so the database itself returns only rows that belong to the signed-in person’s agency.
Within an agency, people see only what their role allows, and copied email is readable only by its mailbox owner in normal views.

Signing in

All agency staff and VextronAI staff complete a second sign-in step from their first sign-in. Contacts using the contact portal must too. Candidates and temps can choose to. The second step is an authenticator app or a passkey. We never use text-message, email or phone codes for it, and signing in with Google or Microsoft doesn’t replace it.
Sensitive actions need a second step taken within the configured window (10 minutes by default): changing roles and permissions, changing a member’s IP allow-list, connecting a mailbox, building a timesheet export, VextronAI support opening an agency’s account, removing a second step, making new recovery codes, approving a second-step reset, and changing a sign-in email address.
Repeated wrong codes are limited, and adding or removing a second step, or using a recovery code, signs the person out everywhere else.
The app signs staff out after a period of inactivity, 30 minutes unless the agency sets between 5 and 60, and after 12 hours at most. Portal sessions have their own limits: up to 30 days for candidates and 24 hours for contacts.

Backups

Our database provider keeps daily backups for 7 days, in London.
Our own off-site backups are encrypted before they leave our systems and are stored in the EU.

Access logging

Every agency has a security log that’s always on. It records sign-ins, every change, exports, permission and setting changes, sensitive reads, deletes and disconnects. Agency administrators can search it: the security-log view shows metadata for the last 12 months, without record content.
When VextronAI support opens an agency’s account, we record who opened support access, when and why, and keep that record for 12 months. In the agency’s own log, the action shows as VextronAI support.
Every second-step sign-in event is kept in a log that can’t be edited.

If something goes wrong

If a personal-data breach affects an agency’s data, we tell the agency without undue delay, so it can meet its own duties. Where the law requires, we also tell the regulator and the people affected.

Report a security issue

If you think you’ve found a weakness in VextronAI, please tell us. We’d rather hear about it early, and we read every report. You don’t need to be a customer to send one.

Email [email protected], with “Security” in the subject line.

Please include as much of this as you can. A short report is better than none:

where the problem is: the page address, or the part of the app;
what you did, step by step, so we can repeat it;
what you expected to happen, and what happened instead;
what you think someone could do with it;
the browser or device you used, and when you tried it;
whether you’d like to be credited, and the name to use.

We don’t publish an encryption key yet. If your report includes anything sensitive, say so in your first message and we’ll agree a safe way for you to send the details.

What we’ll do

Acknowledge your report within 3 working days.
Keep you updated as we look into it, and tell you when it’s fixed.
Keep your report confidential, and share it only with the people who need it to fix the problem.
Credit you by name if you’d like, once it’s fixed.

Please give us reasonable time to fix a problem before you tell anyone else about it. We don’t currently offer payment or rewards for reports.

What’s in scope

In scope: vextronai.com and the VextronAI app. Out of scope:

services run by other companies, even when we use them (please report those to their owners);
social engineering, such as tricking or phishing our people or our customers;
denial of service: anything that overloads or disrupts the service for others;
physical attacks on offices, equipment or people.

Safe harbour

If you act in good faith and follow this page, we’ll treat your research as authorised and won’t take legal action against you for it. Acting in good faith means you:

stay within the scope above;
test only with accounts and data you own or have permission to use;
don’t disrupt the service for other people;
stop and tell us as soon as you find a problem, rather than carrying on to see how far it goes;
keep the details private until we’ve had reasonable time to fix it.

This page speaks only for Vextron Ltd. We can’t give permission on behalf of anyone else, including the companies behind the services that are out of scope.

Please don’t access or change other people’s data

A recruitment platform holds personal information about real people. If you find a way to see someone else’s data, stop there. Don’t open, copy, change, delete or share it, and don’t keep any of it. Tell us straight away, and describe what you found without including the data itself.