Trust

Security

What VuseDesk does today, what we do not claim, and how to report a security issue.

Infrastructure Application Accounts Payments Your data What we don't claim Report an issue

Infrastructure

VuseDesk runs on a modern, globally distributed cloud platform. There is no legacy server for an attacker to find.

Encryption in transitEvery connection is HTTPS/TLS. Plain HTTP is redirected and HSTS is enforced.
Encryption at restYour database and your file storage are encrypted at rest.
Isolated runtimeApp code runs in a sandboxed, isolated runtime, not a shared server you could pivot from.
DDoS and edge protectionRequests pass through network-level protection before they ever reach the app.

Application security

  • Tenant isolation. Every database query is scoped to your workspace. One business can never read or write another's data.
  • Role-based access. Five roles (owner, team member, client, subcontractor, platform) each see only what their role allows, enforced centrally at the gate on every request, not page by page.
  • Hardened response headers. A strict Content-Security-Policy, X-Frame-Options DENY, X-Content-Type-Options nosniff, a locked-down Permissions-Policy, and HSTS are set on every response.
  • Signed payment webhooks. Every Stripe webhook is cryptographically signature-verified and de-duplicated before it can change an account.
  • Secrets stay out of the code. API keys and signing secrets live in an encrypted secret store, never in the source and never shipped to the browser.
  • Input validation and size limits on request bodies, with a honeypot and throttling on public forms.

Account security

  • Passwords are never stored. We keep only a strong one-way hash combined with a server-side secret, so a database copy cannot reveal a password.
  • Secure sessions. Session cookies are HttpOnly, Secure, and SameSite, with a limited lifetime (shorter for contractors than clients) and each session records its IP and device.
  • Brute-force protection. Repeated failed logins are rate-limited and then locked out, and login attempts are recorded.
  • Password reset uses single-use, time-limited tokens.
  • Two-factor authentication is available on any account, using a standard authenticator app. Turning it on asks for your password first, and turning it off asks for your password and a current code, so a stolen session cannot quietly remove it. Enrolment issues ten recovery codes, stored only as hashes, so a lost phone is not a lost account. Each code is accepted once and then burned, so a code read over your shoulder cannot be used again.
  • Read-only support view. If you ever ask us to look at your account, that access is read-only by design and every mutation is refused.

Payments

  • Card data never touches our servers. Payments run on Stripe's hosted checkout, so full card numbers and CVV go directly to Stripe, not to VuseDesk.
  • PCI handled by Stripe. Stripe is a PCI Level 1 service provider; our integration is built so card data is never stored or transmitted by us.
  • Your money never comes here. Your clients pay you directly, by whatever means you and they already use, and you record it against the invoice. VuseDesk has no payment path for your customers at all, so it never collects, transmits or stores a card number or a bank detail belonging to one of them, and it is not a payment processor, a money transmitter or a merchant of record for them.

Your data

  • The database is backed up continuously, with point-in-time recovery to any moment in the previous 29 days. We also keep portable exports that do not depend on our hosting account still existing.
  • We test that the backup actually restores, rather than assuming it. The most recent drill restored a full copy onto a separate database and confirmed every table, index and workspace came back intact. Last tested 29 September 2026.
  • Uploaded files are backed up too. Photos, signed PDFs, certificates and tax documents are held in redundant object storage and copied nightly into a separate backup store that nothing serves from and no routine job ever empties. Until 29 September 2026 this did not exist and those files lived in one place only; it was found by testing the restore rather than by losing anything, and it was closed the same day.
  • Immutable audit log. Sensitive actions (signatures, payments, permission changes, subscription events) are written to an append-only trail.
  • You own it, and you can leave with it. Export your data while active; after cancellation your workspace stays available to export, and we do not automatically delete it. Ask us to delete it whenever you want.
  • No AI training on your data. VuseDesk's core platform does not send your workspace data to any AI model, and does not use it to train one.

Certifications and compliance

We would rather be trusted than sound impressive, so we will not use security theater. As of now, VuseDesk is not SOC 2, HIPAA, or PCI certified, and we do not use phrases like "bank-level" or "military-grade" security. Those are claims that require independent audits we have not completed.

What is written above is what we do today. We intend to pursue independent assurance, starting with SOC 2 readiness, and will say so here when that changes.

Report a security issue

If you believe you have found a vulnerability, we want to hear from you. Email [email protected] with Security in the subject line, so it is routed as a report rather than as a support question. The same policy is published in machine-readable form at /.well-known/security.txt.

What helps us

The URL or endpoint, the steps to reproduce, what you were signed in as, and what you were able to see or change that you should not have been. A screenshot or a short recording is welcome. You do not need to write a formal report.

What we ask

  • Test only against accounts you control. Do not access, modify or keep anyone else's data. If you reach someone else's information by accident, stop, and tell us what you saw so we can measure the exposure.
  • Do not run tests that degrade the service for other customers.
  • Give us a reasonable chance to fix the issue before you disclose it publicly.

What you get

An acknowledgement, an honest answer about whether it is a real finding, and credit if you want it. We do not run a paid bounty, and we say so rather than letting you find out after the work. We will not pursue legal action against anyone acting in good faith under this policy, and a report made in good faith will never be treated as a breach of our Acceptable Use Policy.

Last reviewed September 29, 2026. This overview describes current practices and is provided for transparency; it is not a warranty or a contract.