Security is not an afterthought.
This is a pre-launch marketing site with no user accounts, login, or dashboard — every route is public. TLS/HSTS in transit, Cloudflare Turnstile on every public form, a locked-down set of security headers, and Razorpay-hosted payment collection. This page documents what we actually do today to protect this site and the data it collects, not what a full SaaS platform would need.
The main VANTAGEVID product has not launched yet either — once it goes live with accounts and a dashboard, that product will publish its own, separate security documentation reflecting that larger surface area.
Compliance
GDPR
EU General Data Protection Regulation
European Union
CCPA
California Consumer Privacy Act
California, USA
DPDP
Digital Personal Data Protection Act
India
WCAG 2.1 AA
Web Content Accessibility Guidelines
Global
Compliance is self-assessed and actively maintained. We conduct internal compliance reviews before each major release. For enterprise compliance documentation, contact [email protected].
Security Practices
Encryption & data handling
- HTTPS/TLS enforced at the edge, with HTTP Strict Transport Security pinned for 2 years, including subdomains, plus preload
- No application-level field encryption — personal data relies on standard database and hosting-provider protections: network-restricted database access plus disk-level encryption where our hosting provider offers it
- Card details are collected directly by Razorpay’s Checkout modal and never reach our infrastructure
No authentication surface
- This site has no login, no user accounts, and no dashboard — every route is public
- No passwords, sessions, JWTs, MFA, or role-based access control exist, because there is nothing to authenticate into
- No OAuth or third-party sign-in flows — confirmed by this site’s own middleware, which handles locale routing only and performs no auth checks
Monitoring & incident response
- Sentry error monitoring across the browser, server, and edge runtimes — session replay/recording is explicitly disabled
- A documented incident-response runbook with defined severity levels, covering database outages, payment/webhook failures, and suspected compromise
- 72-hour breach-notification commitment under GDPR Art. 33 and India’s DPDP Act
Infrastructure & API security
- Content Security Policy with an explicit, narrow origin allowlist — no wildcard script-src or img-src
- X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and a locked-down Permissions-Policy on every response
- Per-IP rate limiting on every public API route — waitlist, contact, newsletter, checkout, and all free AI tools
- Free AI tool inputs are stripped of newlines before being interpolated into AI prompts
- No raw SQL — Prisma ORM with parameterized queries throughout
Data minimisation & privacy
- Free AI tools send only what you type in — a topic, keyword, or channel handle — never a name or email, since this site has no accounts to attach one to
- Cookie consent is required before any non-essential cookie is set, and a Global Privacy Control signal is honored automatically
- No self-service data export or deletion tool exists, since there’s no account to log into — access, correction, and erasure requests are handled manually via Contact
Application security
- Gitleaks secret scanning on every push and pull request — blocks any commit containing a real credential
- OSV-Scanner dependency vulnerability scanning in the same CI pipeline
- No hardcoded secrets — Razorpay, Turnstile, Resend, and Sentry credentials are read only from environment variables; Turnstile verification fails closed if its secret key is missing, rather than silently skipping the check
- Formal third-party penetration testing has not yet been performed; it’s planned alongside our in-progress SOC 2 / ISO 27001 programs
Third-Party Security
We carefully evaluate every third-party service for security posture before integration. Current third-party services with data access:
Responsible Disclosure
We take security vulnerabilities seriously. If you discover a security issue in VANTAGEVID, we ask that you report it to us privately before public disclosure so we can investigate and remediate.
Email: [email protected]
Response SLA: Initial acknowledgement within 48 hours. Fix timeline communicated within 7 days.
Scope: vantagevid.io, api.vantagevid.io, and all subdomains.
We do not pursue legal action against researchers who discover and report security issues in good faith. We credit researchers in our changelog unless they prefer anonymity.
Enterprise security review
Need a custom security questionnaire, DPA, or compliance documentation? Contact us.