Security First Approach
At Valiyou, security is not an afterthought—it's built into every layer of our platform. We implement industry-leading security measures to protect your data from unauthorized access, loss, or disclosure.
Encryption
Data in Transit: TLS 1.2+ (HTTPS) for all connections
Data at Rest: AES-256 encryption (Supabase managed)
Password Storage: bcrypt hashing (salt rounds: 10, OWASP recommended)
API Keys: bcrypt hashing (not reversible)
Access Control
Authentication: Better Auth with secure session management
RBAC: Role-Based Access Control (Admin, Reports, Sales, Transfer, Marketing, Brand, Users, Billing, Settings, Plugins, Audit Log, API, Approver)
RLS: PostgreSQL Row Level Security policies
Principle: Least privilege - access on need-to-know basis
Infrastructure Security
Database: Supabase (AWS eu-west-1, Dublin, Ireland) - SOC 2 Type II
Hosting: Vercel (Paris, Stockholm, Frankfurt - EU) - ISO 27001:2022, SOC 2 Type II
DNS & CDN: Cloudflare (global network, DDoS protection included)
DDoS Protection: Cloudflare automatic mitigation + Vercel
WAF: Cloudflare Web Application Firewall (OWASP protection)
Firewall: Cloud provider firewalls (Cloudflare, Vercel, Supabase)
Application Security
SQL Injection: Parameterized queries, prepared statements
XSS Protection: React auto-escaping, Content Security Policy
CSRF Protection: Better Auth CSRF tokens
Bot Protection: Google reCAPTCHA v3
Backup & Recovery
Automated Backups: Daily automated backups (Supabase)
RPO (Recovery Point): 24 hours maximum data loss
Retention: 30 days backup retention
Encryption: Backups encrypted with AES-256
Monitoring & Logging
Audit Logs: All data changes logged with before/after values
Login Tracking: Timestamps, IP addresses, success/failure
Security Events: Failed auth attempts, suspicious activity
Retention: Audit logs retained for 1 year
Incident Response Process
1
Detection
Real-time monitoring
2
Containment
Within 1 hour
3
Investigation
Within 24 hours
4
Notification
Within 72 hours (GDPR)
5
Remediation
ASAP + Review
Certifications & Compliance
GDPR Compliant
Full compliance
SOC 2 Type II
Supabase & Vercel
ISO 27001:2022
Hosting (Vercel)
PCI DSS Level 1
Payments (Stripe)
Report a Security Issue
If you discover a security vulnerability, please report it to our Trust Center team immediately. We take all security reports seriously.
Contact Trust Center