Security is foundational to VylintShield. We protect your assessment data, generated documents, and portal access with a set of controls described below. VylintShield is not itself certified under SOC 2, ISO 27001, or any other compliance framework at this time.
🔒 We maintain a responsible disclosure program. Report a suspected vulnerability to security@vylintshield.com.
Security Architecture
Encryption
TLS 1.2 or better in transit. Data at rest is encrypted as provided by our hosting and database providers.
Access Control
Email + unique access code authentication, session-based.
Application Security
Content-Security-Policy, Strict-Transport-Security and X-Frame-Options security headers. Parameterized queries and input validation.
Secret Scanning
Automated secret scanning runs in CI on every change.
Dependencies
Dependencies are pinned with integrity hashes via a committed lockfile.
Payments
No card data is stored by VylintShield. Payments are processed by Stripe; PCI DSS SAQ A scope.
Data Protection
| Control | Implementation |
|---|---|
| Data Retention | See our Privacy Policy §4 for retention periods by data type. |
| Subprocessors | Vercel, Stripe, Neon, Resend, and Google Analytics, each under a data processing agreement. See Privacy Policy §3. |
Reporting a Security Issue
We take all reports seriously. Email security@vylintshield.com with:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Your contact info (for coordination)
We review every report and aim to acknowledge it promptly.
Security Contact
- General: security@vylintshield.com
In the event of a confirmed breach, we will provide notification within 72 hours where required by applicable law. See our Privacy Policy §7 for more.