Security

Data and infrastructure

• Locked-down servers — our servers are reachable only through our web gateway, and the database accepts connections only from our servers.
• Encrypted in transit — every connection uses HTTPS (TLS), and browsers are told to use nothing else (HSTS).
• Encrypted at rest — the database is encrypted on disk. Credentials for connected accounts (WhatsApp, Facebook, Google, email and CRM keys) are additionally encrypted with AES-256-GCM, are never shown back in full, and never appear in logs.
• Passwords — stored only as salted, slow hashes. Sign-in links and reset codes are single-use and expire quickly.

Workspace isolation

Every record in VixSync belongs to one workspace, and every database query is limited to the workspace of the person asking. Automated tests check, for each kind of data, that one workspace can never read or change another’s. Permissions are checked on our servers on every request, not only hidden in the screen.

Accounts and access

• Two-step sign-in — anyone can protect their account with an authenticator app; it is mandatory for VixScale staff.
• Roles — owners, admins, agents and viewers see only what their role allows.
• Sessions — you can see every device signed in to your account and sign them out. Changing your password signs out every other device.
• Brute-force protection — sign-in, sign-up, reset and API requests are rate-limited per address and per account.

VixScale staff access — only with your approval

VixScale staff cannot see your conversations, contacts or messages unless you approve it. There are two kinds of staff access:

• Setup access — lets our team build your assistant’s knowledge base and settings. It reaches nothing else — no inbox, contacts, messages or billing. It is on so we can onboard you, and the owner can switch it off at any time in Settings → VixScale access.
• Full access — when we need to look into something with you, we send a request with the reason. The owner approves it for 1 hour, 1 day or 7 days, view-only or with changes, or refuses it, and can end it at any moment.

While staff are inside, everyone in the workspace sees a banner, and every visit is recorded in your workspace’s audit log.

The only exception is an emergency: stopping an active security incident or abuse, or a lawful order. Even then, access is limited in time, a reason is required, and the workspace owner is emailed immediately.

Audit log

Team and permission changes, connected accounts, exports, deletions and staff access are written to an append-only audit log that workspace owners and admins can read in Settings, and each person can see their own recent sign-ins and devices. Audit records are kept for one year.

Integrations and the API

• Incoming webhooks from messaging, email and payment providers are accepted only with a valid signature, then processed once, even if delivered twice.
• API keys are scoped to the permissions you choose, can be limited to your server’s IP addresses, are rate-limited, and can be revoked at any time. Only a short prefix is ever shown after creation.
• Facebook, Instagram and Google connections request only the permissions the feature needs, and disconnecting deletes the access tokens.

Your data, under your control

Owners can export their workspace data at any time and close the workspace themselves; it is permanently deleted 30 days later. Contacts can be deleted individually, which also removes them from past conversations. How long everything else is kept is listed in our Privacy Policy.

Building it securely

• Every change must pass type checks, linting and automated tests, including the workspace-isolation tests, before release.
• Dependencies are scanned for known vulnerabilities and secrets are kept out of source code.
• Production secrets live only on the servers, never in code or chat tools.

If something goes wrong

We have a written incident process. If a security incident affects your data we tell you without undue delay with what happened, what it affects and what we are doing, and we report to CERT-In and the Data Protection Board of India as Indian law requires.

Report a vulnerability

Found a security issue? Email connect@vixscale.com with the subject “Security report” and the steps to reproduce it. We acknowledge reports within 2 working days. Please test only against your own account, don’t access or change other people’s data, and don’t run denial-of-service or spam tests. We won’t take action against research done in good faith within these rules.