Legal Center

Velora Legal

Security Measures

Version 1.0Effective Current

Contents

These measures describe Velora’s current V1 security baseline. They are deliberately specific to controls that exist in the production architecture and do not claim certifications that Velora does not hold.

  • Workspace-centric tenancy. Customer data is associated with a workspace and access is enforced using Supabase authorization/RLS patterns and application-level role/responsibility checks.
  • Roles include owner, admin and agent. Customer data access is scoped by role, workspace membership and responsibility. Team oversight does not automatically grant access to separately restricted Vault documents.
  • Production provisioning for brokerage pilots creates workspace memberships before first login to prevent accidental personal-workspace creation and cross-tenant routing errors.
  • User authentication is provided through Supabase Auth. Sessions use server-side/SSR cookie handling in the web application.
  • Password recovery uses a scanner-resistant flow in which the emailed GET route does not consume the recovery token; token verification occurs only after explicit user action.
  • Public self-service signup is disabled for the founding-pilot path; users are operator-provisioned before access.
  • Each activated user receives a unique personal inbound forwarding address. The address is treated as a bearer credential and is visible only to its owner in the authenticated product.
  • Inbound content cannot choose canonical workspace identity or permissions. The system resolves routing against canonical recipient/workspace state before attaching work to contacts or opportunities.
  • Brokerage owners and operators are not sent users’ magic inbound addresses by email.
  • Financial/Vault documents use a separate authorization model. Deal reassignment does not automatically grant the new responsible user access to Vault content.
  • Vault information is prevented from leaking into generic persistent context/Inbox pathways where authorization would be broader than the Vault permission boundary.
  • AI model calls are made through configured business/API services rather than consumer chat accounts. Velora’s OpenAI API use is subject to OpenAI business/API data controls under which API inputs and outputs are not used for training by default unless explicitly opted in.
  • AI-generated external communications remain subject to human approval where the product presents an approval step. Model output is treated as assistive, not authoritative.
  • Canonical application data is stored in Supabase/Postgres and controlled storage. Supabase production features provide encrypted cloud infrastructure and project backup capabilities according to the subscribed plan.
  • Application traffic uses HTTPS/TLS. n8n Cloud states that its cloud data is hosted in the EU and encrypted in transit and at rest; its credential database and backups are encrypted.
  • Vercel hosts the customer-facing web application. Production functions are currently deployed in the dub1 region.
  • Production secrets are kept outside source control and are not committed to GitHub. Provider keys/credentials are configured in the relevant secure environment/provider stores.
  • Production changes follow a scoped preflight, mutation and read-back/verification pattern. The engineering repository is version controlled and production changes are documented.
  • Canonical lifecycle state is stored in Supabase. Recovery logic is designed to make stranded workflow items visible/retryable rather than silently lost.
  • Operational and workflow providers may maintain execution/security logs under their own configured retention windows. Velora limits disclosure of such logs to operational/security needs and applicable provider access controls.
  • Security-relevant and business activity events may be recorded for provenance, outcome and operational audit purposes.
  • Market Discovery is intended to operate on public-web market information and is architecturally separated from customer confidential context. Customer Personal Data should not be sent to public-web search providers unless a future feature is deliberately designed and disclosed for that purpose.
  • Generated outputs are separated conceptually from authoritative source material, and provenance/context boundaries are preserved where the product relies on retrieved information.
  • Velora maintains an incident-response procedure covering triage, containment, evidence preservation, provider coordination, customer notification and remediation. Processor incidents affecting Customer Personal Data are escalated to the affected Customer without undue delay.