Security

Credentials — database keys, provider keys, signing secrets — are held in a managed secret store and injected into the running service at deploy time. They are not committed to the codebase, and they are not present in anything the browser downloads.

Keys that reach the browser are, by construction, only those that are safe to be public. Everything that grants real access stays server-side.

Every analysis, buyer, contact, and deliverable belongs to exactly one account. Requests are authenticated, and each query is scoped to the requesting accountbefore it returns anything — one customer’s work is never reachable from another customer’s session.

The database itself refuses anonymous and end-user connections outright: it is reached only by the application, using a server-side identity, over an encrypted connection. Enforcement of who-owns-what lives in the application layer.

We never see your card. Card details are entered with our payment providers, on their infrastructure. V-Rail does not receive, process, or store card numbers, and there is no card data in our database to lose.

What we store is the outcome: which purchase was made, for how much, and when — the record you would need for your own accounting. Payment notifications from providers are cryptographically verified before we act on them, so a forged “paid” message cannot credit an account.

Charges are computed and applied server-side only. Nothing the browser sends can set a price. See Billing.

Traffic is served over HTTPS with strict transport security. The application ships a content security policy that restricts which code the page is permitted to load at all, so an injected third-party script has nowhere to run from.

We set no advertising cookies and show no cookie banner. The only cookies are the strictly-necessary session cookies issued when you sign in. Details in the privacy policy (§9).

V-Rail is operated by a small team. We hold no third-party security certification or audit attestation, and we will not imply one. If a certification becomes relevant to you before we have it, tell us — we would rather lose the sale than overstate the posture.

Found something? Write to maxie@vrail.io. We will acknowledge, and we will tell you what we did about it.