Trust center

Security at VAIONYX

A public overview of how VAI IA approaches application security without exposing confidential architecture or operational details.

Effective: 2026-07-28Version: 2026-07-28.1

1. Scope and security posture

This overview covers the VAI IA website, dashboards, APIs, assistants and configured integrations. Controls may differ by environment, feature and provider. It does not represent a certification, penetration-test result, service-level commitment or guarantee that every security event can be prevented.

Stripe billing is prepared in code but disabled by default. Meta messaging channels are also disabled by default pending verified integrations and provider approval.

2. Application and infrastructure controls

  • Authenticated dashboard routes use signed server-side session tokens stored in HTTP-only cookies.
  • Security headers, SameSite cookies, origin controls, request-size limits, input validation and targeted rate limits reduce common web and cross-site request risks.
  • Webhook signatures are validated and billing-event idempotency prevents one event from being intentionally applied twice.
  • Feature flags act as kill switches for unverified billing, Meta integrations and other rollout-sensitive functions.
  • Secrets belong in environment configuration; stored integration credentials are protected and are not intentionally returned unmasked to public client code.
  • Dependencies, safe error handling, builds and deployment changes should be reviewed and tested before production activation.
  • Preview and production configuration should remain separated.

Individual administrative accounts, least-privilege permissions and multi-factor authentication should be used whenever the applicable identity or infrastructure provider supports them.

3. Confidentiality, integrity and availability

HTTPS/TLS is expected for production traffic. Sensitive provider credentials stored by the application are encrypted using configured application secrets. The service minimizes data exposed through public endpoints and does not intentionally expose service-role credentials to browsers.

Validation, authorization, database constraints and controlled changes support integrity. Monitoring, recovery procedures and provider backups support availability when configured and available; no uptime guarantee is made here. Data retention, backup, deletion and recovery depend on the applicable service, customer configuration and provider capabilities. See the Privacy Policy and Data Processing Agreement.

4. Access control and tenant separation

Business data is associated with a tenant identifier. Server-side authorization derives tenant context from authenticated sessions for protected operations. Database tables use row-level security and restricted grants as defense in depth; privileged server credentials must only be used by trusted backend code.

Administrative access should follow least privilege, unique accounts and prompt removal when access is no longer required.

5. Monitoring and incident response

Operational logs, safe error handling and provider events can support diagnosis, billing reconciliation and abuse investigation. Logs should avoid secrets and unnecessary sensitive content. If a confirmed incident affects personal data, VAIONYX LLC will assess scope, contain the event, preserve relevant evidence and provide notices when required by applicable law or contract.

Specific detection methods, internal endpoints, data layouts and response procedures are confidential to avoid weakening the service.

6. Shared responsibility

Customers are responsible for authorized-user access, strong credentials, accurate permissions, secure endpoint devices, lawful collection instructions, channel approvals, configured integrations, backups they control and promptly reporting suspected misuse. Providers remain responsible for their own platforms under their agreements.

7. Report a vulnerability

Send a concise report to coceo@vainyx.com with the affected surface, reproduction steps, impact and contact details. Do not access other users' data, disrupt availability, use social engineering, send spam, exfiltrate data or publish an unresolved issue.

We will acknowledge good-faith reports when practical. This page does not create a bug-bounty program or promise payment, safe harbor, response time or remediation deadline.