How we protect your data
VouchSafe holds your trusted contacts, payment cases and audit trail, so it has to be held to the standard it asks of you. This page describes what is in place today and what isn't yet.
Your workspace is kept separate
On the hosted version, each business's directory, cases and audit log live in a database file of their own, not in tables shared with other customers. Every request is tied to a single workspace, and the server code refuses to read workspace data unless it is. Sign-in sessions and add-in tokens carry their workspace and are only ever checked against it.
VouchSafe staff manage workspaces from an operator page that shows each workspace's name, plan, status and callback counts, not its contents. Anyone with administrative access to the servers could technically read stored data; that access is limited to VouchSafe's founder.
If you run VouchSafe on your own server, your data stays there and the hosting details below don't apply.
Encryption
- In transit: HTTPS only, with HSTS telling browsers never to connect without it.
- Accounting tokens for QuickBooks and Xero, and your own Twilio credentials if you add them, are encrypted with AES-256-GCM using a key derived for your workspace alone.
- Passwords are hashed with scrypt. Session and add-in tokens are stored only as hashes.
- Callback codes are never stored: only a keyed hash (HMAC) is kept, and codes expire after 10 minutes and lock after 5 wrong attempts.
- At rest: the disk holding all workspace databases, and its daily snapshots, are encrypted at rest by our hosting provider, Render.
Access controls
- Roles for requesters, verifiers, approvers and admins. Anyone can stop a payment; only verifiers and approvers can release one.
- Separation of duties: the person who opened a case or made the callback can never give the second approval.
- Callbacks always go to the number in your trusted directory, never to one taken from a message. A number that was just changed can't be used for VouchSafe-placed callbacks for 24 hours.
- Sign-in sessions last 12 hours in HttpOnly cookies. Changes require a matching origin and a custom header, which blocks cross-site request forgery. Sign-in attempts are rate-limited.
- New users get a temporary password they must change at first sign-in. Add-in tokens are per person and can be revoked at any time.
Tamper-evident audit log
Every action in a workspace is written to an append-only log, with each entry chained to the previous one by a SHA-256 hash. You can check the chain's integrity in one click and export the log as CSV for your bank, insurer or auditor. When VouchSafe staff change your workspace's plan or status, that is recorded in your log too.
Who else handles your data
- Hosting: Render (render.com) runs our servers and stores the encrypted disk in its Virginia (US East) region.
- Stripe takes card payments for our plans on its own secure page. Card details go to Stripe, never to VouchSafe.
- Twilio sends text and voice callbacks. It receives the phone number from your directory and the message containing the one-time code.
- QuickBooks Online and Xero, only if you connect them. This guard is still in testing. VouchSafe reads supplier records and, where the ledger exposes bank details, can compare and restore them.
Backups, retention and deletion
Render takes an encrypted snapshot of the data disk automatically every 24 hours and keeps each snapshot for at least 7 days. Snapshots stay within Render's infrastructure and can only be restored by VouchSafe.
We keep a workspace's data for as long as the workspace is open. Admins can export the audit log as CSV at any time; for a full copy of a workspace, email us from an admin address. When a workspace is closed, we delete its data from our live systems within 30 days. Copies left in Render's encrypted snapshots expire on Render's rotation schedule after that, and if we ever restore a snapshot, we delete closed workspaces again straight away. Server logs kept by Render expire after 7 to 30 days, depending on our Render plan. Partner inquiries are kept for up to 24 months.
What we haven't done yet
We'd rather tell you than have you assume:
- No independent penetration test yet.
- No SOC 2, ISO 27001 or other certification.
- No two-factor sign-in or single sign-on (Microsoft Entra ID, Google) yet.
- Sign-up doesn't verify email addresses yet.
Reporting a vulnerability
Email [email protected] with "Security" in the subject. Please include what you found, the steps to reproduce it, and the impact you think it has. Please don't access other customers' data, disrupt the service or publicise the issue before we've had a chance to fix it.
We'll acknowledge your report within 3 business days and keep you updated until it's resolved.
Safe harbor. If you make a good-faith effort to follow this policy, we consider your research authorized, we won't pursue or support legal action against you for it, and if a third party takes action against you we'll make it known that you acted under this policy. Good faith means you test only against your own workspace or accounts, stop as soon as you reach anyone else's data, don't keep or share what you saw, don't degrade the service or send spam, and give us reasonable time to fix the issue before telling anyone else. This doesn't cover testing of third-party services such as Render, Twilio, QuickBooks or Xero; follow their own policies.