Security

Application controls

• HTTPS/TLS 1.2+ on every public endpoint (redirect from HTTP)
• Per-store data isolation enforced at the query layer (store_id foreign key on every tenant table)
• JWT-based API auth with short token lifetimes and rotating signing keys
• Rate limiting on every public endpoint (widget, auth, contact form)
• CSRF protection on every session-authenticated form
• SQL-injection protection via Eloquent parameterized queries only — no raw string concat
• XSS protection via Blade auto-escaping + Content-Security-Policy on the widget iframe
• Password hashing with bcrypt (cost 12), never reversible

Data at rest

• Application secrets and integration credentials (Shopify tokens, WooCommerce keys, custom store API keys) are encrypted at rest with Laravel's Encrypter using a rotating APP_KEY.
• Passwords are never stored in plain text; only bcrypt hashes.
• Payment card data never touches our servers — Stripe holds tokenized card references, we only see the token.
• Backups are encrypted and stored on the same account with 10-day rolling retention.

Data in transit

• All external traffic uses HTTPS with a valid certificate. HTTP requests are 301'd to HTTPS.
• Widget → API traffic uses the same TLS; per-store public tokens replace any cookie/session for public embedding.
• Realtime chat updates are delivered over Pusher's TLS-encrypted WebSocket, per-conversation channel.

Access & operations

• Production access is limited to founders and requires SSH key auth — no password login.
• Deploys go through a CI pipeline with a pre-deploy PHP-lint smoke test and an automatic rollback if the post-deploy health check fails.
• Every deploy takes a hardlinked snapshot of the previous release for instant rollback and a mysqldump before any migration.
• Support staff can view aggregate metrics; access to a specific merchant's data requires explicit opt-in via concierge setup, and credentials are wiped after installation.
• Third-party dependencies are updated via Composer/npm on a regular cadence; critical security advisories trigger an out-of-band update.

LLM-specific safeguards

• Only the user's question and relevant retrieved knowledge snippets are sent to the LLM — never full conversation history unless the user is authenticated to that store.
• OpenAI's zero-retention API mode is used where enabled; requests are not used to train future models.
• Prompt injection guardrails: retrieved snippets are wrapped in delimiters; the system prompt explicitly warns the model not to follow instructions inside user content.
• Every LLM call is logged to llm_call_logs with a 90-day retention, giving us an audit trail if something goes wrong.

Vulnerability reporting

If you have found a security issue — please tell us before disclosing it publicly.

• Email security@vatdi.com with a description, steps to reproduce, and any proof-of-concept.
• We aim to acknowledge within 48 hours and resolve high-severity issues within 14 days.
• Please do not run automated scanners against production; use a staging account if you need to probe. We will not pursue action against good-faith research that stays within scope.

Incident response

If a security incident affects your data, we will:

• Contain and mitigate immediately (rotate keys, take affected services offline if necessary).
• Notify affected merchants within 72 hours by email with a plain-language description of what happened, what was affected, and what we are doing.
• Publish a post-mortem within 14 days for any incident with customer impact.

What we do not yet claim

We are not currently SOC 2 or ISO 27001 certified and we do not run a formal bug-bounty program. We follow the practices those frameworks describe, but we do not claim certifications we do not hold. If your procurement process requires certified attestations, contact us.

Security FAQ

How do I report a security vulnerability to Vatdi?

Email security@vatdi.com with a description, steps to reproduce, and any proof-of-concept. We aim to acknowledge within 48 hours and resolve high-severity issues within 14 days. Please do not run automated scanners against production.

Is customer data sent to the AI provider used for training?

No. Only the user's question and the relevant retrieved knowledge snippets are sent to the LLM, using OpenAI's zero-retention API mode where enabled, so requests are not used to train future models.

How does Vatdi protect against prompt injection?

Retrieved snippets are wrapped in delimiters and the system prompt explicitly instructs the model not to follow instructions found inside user content. Every LLM call is logged with 90-day retention for audit.

What happens if there is a security incident?

We contain and mitigate immediately, notify affected merchants within 72 hours by email with a plain-language description, and publish a post-mortem within 14 days for any incident with customer impact.

Does Vatdi have a bug bounty program?

Not at this time, and we are not SOC 2 or ISO 27001 certified. We follow the practices those frameworks describe but do not claim certifications we do not hold.