Voilatier handles sensitive information: phone, email, purchase habits. The architecture is built so you and your customers trust every interaction.
Phone and email are stored AES-256-encrypted at rest. In parallel we keep an HMAC-SHA256 hash to spot duplicates without bulk-decrypting. Every web connection requires TLS 1.2 or higher.
Point and stamp movements are recorded in append-only ledgers: entries cannot be updated or deleted through the application. Corrections happen via compensating entries (refund, chargeback), preserving the complete history.
Every meaningful change in the panel is logged with the acting user, timestamp and IP. API keys and manual point adjustments get their own separate trail that only company administrators can read.
Administrator roles require TOTP. We support any standard authenticator (Google Authenticator, 1Password, Authy). Sessions expire on inactivity and failed retries trigger automatic throttling.
Each tenant owns its data. We support full CSV export (portability), soft anonymization that preserves aggregates without PII, and per-tenant configurable retention. Right-to-be-forgotten permanently removes personal data, keeping only anonymous references for consistency.
Voilatier maintains encrypted backups of production data with restricted access, according to its backup and recovery procedures. Restoration procedures are periodically reviewed.
Voilatier maintains procedures for identifying, investigating, containing, and remediating security incidents. Affected customers are notified without undue delay and, in any case, within 72 hours of detection, in accordance with the Data Processing Agreement and applicable legal obligations.
Voilatier operates its services on secure cloud infrastructure provided by DigitalOcean, located in the United States. Customer data is processed and stored in the United States, behind Cloudflare's network for traffic protection.
If you discovered a security issue, email us at [email protected]. We acknowledge within 24 business hours and publicly credit responsible reporters.
