Security at VesperWise

This page lists the security controls in place today, what we are working on next, and the formal programs we have not started yet.

If we don't have a control yet, this page says so. We update it as our security program grows.

Current controls

What we have today.

These controls are live in production as of August 2026.

Authentication

Clerk for user authentication
Dashboard access requires active session
API keys are stored as SHA-256 hashes, shown once and revocable

Infrastructure

TLS encryption in transit (Vercel)
Postgres at Supabase with AES-256 at rest
Cached score results are stored in our database and expire after 6 hours
Hosting providers maintain their own SOC 2 reports

Data handling

Every API request requires a signed-in session or an API key
Database access is restricted to VesperWise backend services, and queries are scoped to the requesting account
Billing webhooks are signature-verified and idempotent
AI summaries are generated through a model provider (see Subprocessors)

Signal sources

Commercial data providers under contract
All signal vendor API calls use HTTPS

In progress

What we're working on.

These improvements are planned as we scale.

Database-level tenant isolation hardening
Automated dependency scanning
Audit logging for administrative actions

Not yet available

Formal audits and programs.

None of these are in place today. Security questions and questionnaires are answered directly by email.

SOC 2 audit
Not scheduled
ISO 27001 certification
Not scheduled
Third-party penetration test
Not scheduled
Public status page or SLA
Not scheduled
Paid bug bounty program
Not offered

Contact

Report a problem.

If you find a security issue, please email security@vesperwise.com with steps to reproduce. We don't offer paid bounties, but every report is read and answered.

For other legal documents, see Privacy, Terms, and DPA and Subprocessors.