SECURITY & TRUST
Security built into the engineering foundation.
We design our systems with security, privacy, and reliability as fundamental requirements. We believe in transparent architecture, defensible boundaries, and honest communication.
Infrastructure & Isolation
- Strict multi-tenant workspace isolation preventing cross-tenant data leakage.
- Containerized workloads deployed in restricted virtual private clouds (VPCs).
- Encrypted transit via TLS 1.3 enforced for all ingress and egress traffic.
Application & Data Security
- Stateless JWT tokens stored exclusively in secure, HttpOnly, SameSite cookies.
- Zero storage of raw user passwords (salted cryptographic hashing via BCrypt).
- Automated input validation and parameterized SQL queries to prevent injection attacks.
Access Control & Least Privilege
- Role-Based Access Control (RBAC) with granular OWNER, ADMIN, and MEMBER permissions.
- Ephemeral credential rotation for background monitoring workers and cron jobs.
- Audit logging on all administrative modifications and tenant membership changes.
Continuous Monitoring & Incident Response
- Internal watchdog health probes running 24/7 with immediate on-call dispatching.
- Automated vulnerability scanning across container images and package dependencies.
- Deterministic incident state machines with clear resolution timelines.
RESPONSIBLE DISCLOSURE PROGRAM
Reporting Security Vulnerabilities
We welcome security researchers and developers to inspect our public interfaces and report potential vulnerabilities responsibly. If you discover a security issue or potential flaw in Vamix or any of our products (including Uptara), please report it to our engineering team immediately.
Security Contact: contact@vamix.netSubmit Vulnerability Report