Security

Isolation between customers

Each organization is isolated by the database itself: PostgreSQL filters every row by organization. A filter forgotten in the application's code therefore cannot expose another customer's data; against a forged query, the defence is the systematic parameterization of queries, reviewed in the code. The Vigilo team goes through a separate connection, reserved for its console. Automated tests check this isolation on every change to the software.

Sign-in and accounts

Sign-in with a one-time link or code, a passkey or a password. Two-factor authentication with an app or a passkey, mandatory for the Vigilo team and available for a whole organization. Limited attempts, time-limited sessions, signed-in devices can be revoked.

Links sent to third parties

Each link is personal, time-limited and revocable; only its fingerprint is stored. It is never passed on to another site or indexed. A code sent by email can also be required.

Transport, files and backups

HTTPS only. Every uploaded file is scanned by an antivirus before it is accepted. Daily encrypted backup, kept 14 days, whose key is never on the server nor with the host of the copies; every night the backup is restored into a throwaway database and checked against the original before it is kept, and a full recovery is rehearsed every month. Servers in the European Union.

Protection of pages

Each page only runs Vigilo's own scripts: a policy with a new key at every page load blocks any other script, and no other site can display Vigilo inside its pages. Requests to the servers are logged without the secret part of links and kept for 6 months. A request that another site sends with your session is refused, and a download link opened from another site asks for a confirmation.

Activity log

Each action is recorded with its author in a log protected by the database: no change and no deletion, except anonymization when personal data is erased or an account is closed, and the purge at the end of the retention period. An intervention of the Vigilo team in your account appears under its name. It shows the person's code (A7 for example), which the support links to their name on request; the team opens your documents only with your consent (Settings › Security), never health data. The IP address and browser are noted for sign-ins, API calls and sensitive actions (exports, API keys, roles, ownership transfer, closure), then erased after 12 months. Retention: sign-ins 12 months, rights, API keys and Vigilo team access 3 years, other actions 5 years; server logs 6 months. Owners and administrators read it in the application, export it or feed it to their SIEM through the API. An API key can be limited to the addresses of your servers.

Your data

Full export of the organization (data and files) at any time, erasure of a third party's data, self-service account closure. No resale of data, no advertising trackers.

Certifications

Vigilo is not yet ISO 27001 or SOC 2 certified and has not yet had an external penetration test. Internal audits (isolation, authentication, file uploads) are carried out regularly.

Report a vulnerability

The reporting address is not published yet. If you have an account, write to us from Support.

Do not access other people's data beyond what is necessary, do not disrupt the service, and give us time to fix the issue before any publication. We will not pursue research carried out in good faith within these limits.