Security & privacy at Velora
Your customer conversations are sensitive. This page describes the technical and organizational measures we use to keep them safe. It reflects our current practices — reach out if you need more detail for a security review.
Data is encrypted in transit with TLS. Secrets and provider API keys are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt — never stored in plain text.
Every request is scoped to your workspace. One tenant can never read another tenant’s conversations, agents, or settings — enforced in the data layer, not just the UI.
Short-lived access tokens with rotating refresh tokens and reuse detection, optional Google sign-in, active-session management, and rate-limited auth endpoints.
Card details are handled entirely by Stripe and never touch our servers. Billing runs through Stripe’s hosted checkout and customer portal.
Access control
Workspaces use role-based access — Owner, Admin, Agent, and Viewer — so people only get the permissions they need. Billing and destructive actions are restricted to admins and owners. Sensitive actions are recorded in an audit log.
Infrastructure hardening
- HTTPS enforced with HSTS, a strict Content-Security-Policy, and standard security headers.
- Rate limiting on the API to blunt abuse and brute-force attempts.
- Health checks and graceful shutdown for reliable, observable deployments.
- Secrets are validated at startup — the service refuses to boot with weak production config.
Your data & privacy
You own your data. You can update your profile, change your password, sign out other devices, and permanently delete your account — which anonymizes personal information and removes the workspaces you own. See our Privacy Policy for full details on what we collect and why.
Backups & continuity
The database is the source of truth and is backed up regularly, with a documented restore procedure. Queue and cache data is transient and reconstructed automatically, so a cache outage never loses your conversations.
Subprocessors
We rely on a small set of trusted providers to deliver the service:
- Stripe — subscription billing and payment processing.
- Your chosen AI provider — generates replies using the model key you configure.
- WhatsApp — the messaging channel you connect to send and receive messages.
Compliance posture
We build to widely recognized security principles and privacy-by-design practices. We are not yet formally certified against frameworks such as SOC 2 or ISO 27001; pursuing them is on our roadmap. We will never claim a certification we don’t hold. If you have specific compliance requirements, contact us and we’ll share what we can.
Report a vulnerability
Found a security issue? We want to hear about it. Please reach out to our team with details and steps to reproduce, and give us a reasonable window to investigate before any public disclosure. We appreciate responsible reporting.