Trust · Security

Security at VesperWise.

VesperWise is an early-stage (v0.1) product built by a solo founder. This page describes the security controls we have today, what we're working toward, and what we don't yet have.

We're committed to transparency: if we don't have a control yet, we'll say so. We'll update this page as our security posture matures.

Current controls

What we have today.

These controls are live in production as of August 2026.

Authentication

  • Clerk for user authentication
  • Dashboard access requires active session
  • API keys hashed SHA-256, shown once, revocable, scoped to user_id

Infrastructure

  • TLS encryption in transit (Vercel)
  • Postgres at Supabase with AES-256 at rest
  • Redis cache at Upstash for 24h TTL
  • All hosting on SOC 2 certified providers

Data handling

  • Score API requires session or hashed API key
  • Credits reserved per scoring run
  • Polar billing webhooks: signature verification + idempotency
  • AI summaries via OpenRouter (not Anthropic; no zero-retention guarantee)

Signal sources

  • Explorium (funding enrichment)
  • GNews, BuiltWith, OpenPageRank, GitHub
  • Apollo (person enrichment)
  • All signal vendor API calls use HTTPS
In progress

What we're working on.

These improvements are planned as we scale.

  • Tighten tenant isolation (current RLS policies exist but service role bypasses them)
  • Implement automated dependency scanning
  • Add audit logging for admin actions
  • Move to row-level isolation enforcement in application layer
Not yet available

What we don't have yet.

We're honest about what we haven't built. This page will be updated as these become available.

  • SOC 2 audit
    Not scheduled
  • ISO 27001 certification
    Not scheduled
  • Third-party penetration test
    Not scheduled
  • Public status page or SLA
    Not scheduled
  • Bug bounty program
    Not scheduled
Contact

Report a problem.

If you find a security issue, please email support@vesperwise.com. We don't have a formal bug bounty program yet, but we take security reports seriously and will respond promptly.

For other legal documents, see Privacy, Terms, and DPA.