Vulu VaultBack to Home

Security Practices

Last updated: September 6, 2026

1. Our Commitment

Security is foundational to Vulu Vault. As a platform handling sensitive compliance documents and business data, we implement multiple layers of protection to safeguard your information.

2. Infrastructure Security

  • Hosting: Deployed on Vercel with automatic scaling, DDoS protection, and edge network distribution.
  • Database: PostgreSQL 15 on Neon with automated backups, point-in-time recovery, and encrypted connections.
  • File Storage: Cloudflare R2 with S3-compatible API, server-side encryption, and presigned URL access control.
  • CDN: All traffic routed through Cloudflare with WAF protection.

3. Data Encryption

  • In Transit: All connections use TLS 1.3. HTTP is automatically redirected to HTTPS.
  • At Rest (Database): Neon PostgreSQL transparent data encryption with AES-256.
  • At Rest (Files): Application-level AES-256-GCM encryption with per-tenant keys derived via HKDF. Each tenant's files are encrypted with a unique key. Cloudflare R2 adds server-side encryption as a second layer.
  • BYOS Tokens: Storage provider credentials encrypted with AES-256-GCM using a separate master key.
  • Passwords: Hashed with bcrypt using adaptive cost factors. Plaintext passwords are never stored.
  • Tokens: Session refresh tokens are stored as SHA-256 hashes. JWT access tokens are short-lived (15 minutes).

4. Authentication & Access Control

  • JWT Authentication: Short-lived access tokens (15 min) with secure refresh token rotation (7 days).
  • Multi-Factor Authentication: TOTP-based MFA support for enhanced account security.
  • Role-Based Access Control: 14-role hierarchy with granular permissions across resources and actions.
  • Rate Limiting: IP-based rate limiting on authentication endpoints to prevent brute-force attacks.
  • Account Lockout: Automatic account lockout after repeated failed login attempts.
  • Session Management: Sessions track IP and user agent; old sessions are revoked on new login.

5. Multi-Tenant Isolation

Every database query is scoped to the authenticated user's tenant. Tenant isolation is enforced at the middleware level - authentication headers are cryptographically verified and cannot be spoofed. Cross-tenant data access is architecturally impossible through normal API usage.

6. Application Security

  • SQL Injection: All database queries use parameterized statements.
  • XSS Prevention: React's built-in output escaping, no unsafe HTML rendering.
  • CSRF Protection: SameSite cookie policy and secure cookie flags.
  • Header Spoofing: Middleware strips incoming auth headers and validates cryptographic timestamps (CVE-2025-29927 mitigated).
  • Dependency Security: Regular npm audit scans with zero known vulnerabilities.
  • Document Security: File type validation, size limits, and malware scanning on uploads.

7. Monitoring & Incident Response

  • Error Tracking: Sentry integration with real-time alerting (with user consent for analytics).
  • Audit Logging: Comprehensive logs of all user actions including IP address and user agent.
  • Health Monitoring: Automated health checks on database connectivity and critical services.

8. Compliance Features

  • Legal Holds: Ability to freeze documents from deletion during legal proceedings.
  • Retention Policies: Configurable data retention with automated cleanup.
  • Data Export: Export your data in CSV or JSON across 7 categories: entities, users, requests, compliance tasks, documents, audit logs, and e-signature records. Supports filtered exports and meets GDPR Article 20 data portability requirements.
  • Export Audit Trail: Every data export is recorded in a tamper-evident audit log with the exporting user, timestamp, categories exported, and record counts.
  • Report Exports: Compliance summaries, SLA performance, monthly trends, entity overviews, audit trails, and project portfolios available in CSV and JSON.
  • Account Deletion: Users can request full account deletion with PII anonymization.

9. Responsible Disclosure

If you discover a security vulnerability, please report it responsibly to security@vuluvault.com. We will acknowledge receipt within 48 hours and work to resolve verified issues promptly. We do not pursue legal action against researchers who follow responsible disclosure practices.