Security is not a feature.
It's the foundation everything else is built on. Here's exactly how we protect your data — and your users' data — at every layer.
Certifications in progress
We are actively pursuing independent third-party certifications. Here's where we stand.
SOC 2 Type II
Independent audit of our security, availability, and confidentiality controls. We are working with accredited CPA firm Schellman & Company. Estimated completion: Q4 2026.
GDPR
EU General Data Protection Regulation compliance. Data Processing Agreement available upon request. We have appointed a Data Protection Officer and implemented data subject request workflows.
CCPA
California Consumer Privacy Act compliance. Privacy notice, data inventory, and consumer rights request procedures are implemented. Final legal review in progress.
How we protect your data
Encryption everywhere
All data is encrypted in transit via TLS 1.3. Data at rest uses AES-256. Passkeys use hardware-backed biometric encryption. Verification tokens are hashed, never stored in plaintext.
Zero plaintext credentials
We never store passwords, verification codes, or raw biometric data. Only cryptographic public keys are persisted. A database breach yields nothing an attacker can use to authenticate.
Infrastructure isolation
Production systems run in isolated VPCs with strict network segmentation. Database clusters are not publicly routable. All access goes through a bastion host with session recording.
Continuous monitoring
Every authentication event, admin action, and API call is logged to an immutable audit trail. Anomaly detection flags unusual patterns in real time — credential stuffing, geographic anomalies, rate spikes.
Regular penetration testing
Independent third-party security firms conduct penetration tests quarterly. Results are reviewed by our engineering leadership and remediated within SLA — critical findings within 24 hours.
Vulnerability disclosure
We maintain a responsible disclosure program. Security researchers can report vulnerabilities to security@vorht.com. We commit to acknowledgment within 48 hours and a fix timeline within 5 business days.
Built on AWS. Hardened by design.
Responsible disclosure
If you discover a security vulnerability in Vorht, please report it to us privately. We take every report seriously and will respond within 48 hours.
security@vorht.com