How we build and test
You can't read our code, so we show you how we work. Everything here is true today. The numbers are dated and refreshed at each release.
Every change is checked before it is merged.
On GitHub, a change cannot be merged until these pass: lint, type checks, unit tests, end-to-end tests against a real database, a secret scan, static security analysis, a dependency vulnerability scan and a full production build.
A structured internal audit before launch.
It found and fixed 41 issues, including 4 severe ones, and listed the areas it did not test. It was an internal audit, not an independent one.
Payments and data.
Card details never touch our servers: payment happens on Razorpay's hosted page. In the VANTAGEVID product, passwords are stored hashed, never in plain text.
Our standard.
We follow our own written Enterprise Standards Framework. It is an internal standard, not an outside certification.
What we are not.
We are not SOC 2 or ISO 27001 certified. Live uptime history begins at launch, on a status page that measures the real services.
Updates.
Release notes at least monthly at /releases, and a current roadmap at /roadmap.
Found a problem?
Write to [email protected]. A short disclosure page and a security.txt file are planned.
More on how your data is handled: Security. The founder's promises: Founder's letter.