We would rather publish a short honest page than a long reassuring one. Everything below is in place today; the last section lists what is not, so you can judge for yourself.
Accounts and sessions
- Passwords are stored as Argon2id hashes — a memory-hard algorithm designed to make offline cracking expensive, not a bare SHA. We never store or log the password itself and cannot recover it for you, only reset it.
- You can sign in with Google instead, in which case no password exists on our side at all.
- Sessions use short-lived access tokens with separate refresh tokens, both carried in
httpOnlycookies so page scripts cannot read them. Cookies are marked secure in production. - State-changing requests additionally require a CSRF token, so a malicious site cannot act as you using your session.
Workspace isolation
Every workspace is scoped separately, and each request is bound to the workspace of the session making it. Endpoints that are deliberately public — the marketing site, the blog, and shared quotation links — are the explicit exception rather than the default, which means a new endpoint is private unless someone opts it out.
Transport and abuse controls
- All traffic is served over HTTPS.
- The API is rate limited, with a tighter limit on the unauthenticated endpoints that customer-facing quotation links use.
- Request bodies are size capped, and cross-origin access is restricted to known origins.
Shared quotation links
A quotation you send opens without a login, so your customer does not need an account. The link carries an unguessable token, and these pages are excluded from search engines — but anyone holding the link can read that document. Treat it like an email attachment. If a link should no longer work, tell us and we will revoke it.
Payments
Card, UPI and net-banking details are handled entirely by Razorpay. They never pass through or rest on our servers, so our systems are not a place payment credentials can leak from.
Reporting a vulnerability
Email security@velocrew.in with enough detail to reproduce the issue. We will acknowledge within three working days and keep you updated until it is resolved.
In scope: this site, the product, and the API. Out of scope: denial-of-service, volumetric or automated-scanner output without a working proof of concept, and anything requiring physical access to a user’s device.
If you are acting in good faith — you report privately, do not access or modify data belonging to anyone else, and give us reasonable time to fix the issue before disclosing — we will not pursue any claim against you. Please do not test against another customer’s workspace; ask us and we will set you up with an account.
What we have not built yet
Being straight about the gaps: we do not yet offer multi-factor authentication, we do not publish a backup and restore schedule, there is no customer-visible audit log, and we hold no formal certification such as SOC 2 or ISO 27001. We have not commissioned an external penetration test. As each of these lands it will be described here rather than announced vaguely elsewhere.
Current service state is on status. Data retention and processors are covered in the privacy policy.