Stored
- Agent, action, resource, destination.
- How many records, not which rows.
- The score, the reasons, the policy, the reviewer.
Trust center
Metadata in. Contents stay with you.
Vulnify stores the action: agent, action, resource, destination, and counts. It does not store the contents of the records. This page does not claim a certification.
What crosses the boundary.
Not stored
- The contents of the records.
- Third-party credentials. They stay in the vault.
Security practices
Tenant isolation
Each organization’s data is isolated with row-level security.
Encrypted vault
Third-party credentials stay in an encrypted vault and are injected only when the decision is ALLOW.
Hash-chained audit
The audit log is append-only and hash-chained per organization. You can verify the chain in the app.
MFA
Accounts can turn on MFA. When it is on, a high-risk approval asks for a fresh code.
Signed webhooks
Webhook deliveries are signed with HMAC-SHA256.
Fail closed
If Vulnify is unreachable, the action does not run, unless you choose fail open.
The audit trail
Every decision appends one row, hash-chained to the row before it. The chain is per organization, and you can verify it from inside the app.
Your data
Export and deletion
From the app settings you can export your data and delete your account. Owners and admins can export the organization (JSON or CSV); only the owner can delete it. Deleting an organization cancels its subscription immediately, with no refund, and cannot be undone.
Backups
The production database is backed up every day. Each backup is encrypted before it leaves the database host, with a key held only by Vulnify, and kept for at most 30 days. Deleted data can remain in a backup until that copy expires. Restore drills are scheduled monthly.
Contact messages
A message sent through the contact form is stored for 12 months, and an email alert is sent so we can reply.
Privacy contact
The data-protection officer (encarregado, LGPD art. 41) is Giovanni Zadinello. Reach him at privacy@vulnify.io.
Subprocessors
Listed by what they do. Each one receives only what that job needs. Customers can ask for the named list through the contact form.
| Function | What it handles |
|---|---|
| Hosting and database | The application and its database, in the United States. |
| Backup storage | Encrypted database backups it cannot read. No specific region is promised. |
| Transactional email | Account emails and contact-form alerts. |
| Payments | Billing for the paid plans. |
| Error monitoring | Error reports, configured not to send personal data by default. No session replay, and no record contents. |
| Website analytics | Cookieless page views on this website, only after you allow analytics. |
Found a security issue?
Report it through the vulnerability disclosure page. Please do not post an exploit in public.