Security

PAD is built on a small, audited stack of best-in-class providers. Here's what we do + what we don't.

Data isolation

• Every row in our database carries a workspace_id and queries are scoped to the authenticated workspace.
• Application-layer enforcement is mandatory; database-level RLS retrofit is on the roadmap (Phase 9.11) and triggers on the first security audit.
• API keys are scoped per-workspace and never shared between workspaces.

Encryption

• TLS 1.2+ for all transport. HSTS enforced.
• At-rest encryption via Neon (Postgres) + Upstash (Redis) + Vercel Blob storage.
• API keys stored as SHA-256 hashes; plaintext only shown once at creation.
• Webhook signing secrets stored encrypted at rest and only readable by the dispatcher.

Authentication

• Dashboard auth via Clerk — SOC 2 Type II, supports SSO + MFA.
• API access via per-workspace bearer keys with scope (browser, server, admin).
• Webhook signatures via HMAC-SHA256 with timestamp + replay protection (Stripe-style).

AI handling

• All LLM calls route through Vercel AI Gateway with zero-data-retention enabled.
• We do not train any models on your customer data.
• Brand voice + agent memory are workspace-scoped and never used as training data.

Operational practices

• Every push to main goes through PR review + CI (build + Playwright smoke).
• Production deploys via Vercel with immutable artifacts + 1-click rollback.
• Error tracking via Sentry; uptime visibility via /status.
• Secrets in Vercel env vars, scoped per environment (Development / Preview / Production).

Vulnerability reports

Email security@thevisualpay.com with details. We aim to acknowledge within 48 hours and provide a remediation timeline within 5 business days. Responsible disclosure earns public credit on this page (with your permission).

Roadmap

• Phase 9.11 RLS retrofit — database-level workspace isolation as a defense-in-depth layer (triggered by first multi-tenant audit).
• Phase 9.7 SOC 2 Type I — formal audit (triggered by first enterprise blocker).
• SAML SSO + Audit log — included in Scale tier.