Security

• datavessel runs on Google Cloud Platform in the EU (region europe-west3): serverless application instances, a managed PostgreSQL database, and Google Cloud Storage. Network protections — firewalling, DDoS mitigation, infrastructure intrusion detection and workload isolation — are provided and operated by Google Cloud.
• All data is encrypted in transit (TLS on every connection, including between our services and databases) and encrypted at rest by Google Cloud's default encryption.
• Platform data retrieved on a merchant's behalf (from the services they connect, such as their store platform, Google, Meta, or Amazon) is scoped to that merchant's account and is never mixed across customers.

• Access to production systems is restricted to the people who operate the service, based strictly on operational need, and is authenticated via Google identity with multi-factor authentication enforced.
• End users sign in to datavessel via OAuth (Google sign-in or email magic link); datavessel does not store user passwords. Password strength and MFA for sign-in identities are enforced by the identity provider.
• Administrative interfaces are role-gated, and every administrative read of customer data is written to an audit log.

• OAuth tokens and customer API keys are encrypted at rest (AES-256) and decrypted only at the moment a request is made on the customer's behalf.
• Application secrets live in Google Secret Manager and are injected at deploy time. Credentials are never hard-coded, never committed to repositories, and never shared between environments or people.

datavessel maintains an incident response plan with defined roles and responsibilities, reviewed at least every six months. It commits us to:

• Detect, contain and remediate any security incident affecting customer or platform data, and preserve evidence for investigation.
• Notify affected customers within 24 hours of determining that their data was involved in an incident.
• Notify the affected platform's security team within 24 hours of detection where platform data is involved — including security@amazon.com for incidents involving Amazon Information, and the equivalent channels for Google and Meta data.
• Revoke and rotate any credentials that may have been exposed, and publish a post-incident summary to affected customers.

Reporting a vulnerability

Found something? Email contact@datavessel.io — reports are acknowledged within one business day, and we do not pursue good-faith security research.