Security
Your customers' testimonials are precious. Here's exactly how we protect them.
Compliance & certifications
Security layers
We don't pick one approach — we stack them all.
TLS 1.3 + AES-256
All data is encrypted in transit with TLS 1.3. API keys are bcrypt-hashed, never stored in plaintext. Data at rest uses AES-256 encryption.
SOC 2 Type II
Hosted on Vercel + Supabase — both SOC 2 Type II certified. Databases are isolated per environment with strict network access controls.
Role-based permissions
Workspace isolation enforced at the API layer. Users can only access their own data. RBAC enforced on every single request.
30-day PITR
Automated daily database backups with 30-day retention. Point-in-time recovery available for any disaster recovery scenario.
24h response SLA
We take security reports seriously. Email us, we respond within 24 hours. Responsible disclosure is always credited publicly.
EU & UK
GDPR-compliant as a data processor. DPA available on request. EU data residency by default. Configurable on Business plan.
Non-negotiable commitments, not marketing copy.
We're grateful for responsible disclosure. Email us with details and we'll respond within 24 hours. Valid reports are always credited.
Report a vulnerabilitysupport@vouchworx.com · 24h response SLA
Get started
Free to start. 15 testimonials. No credit card. Up and running in 3 minutes.