How vFound looks after your data

Where your data lives

The application, database and files are hosted by OVHcloud in Singapore. Encrypted copies of the daily backups are also kept in OVHcloud’s Beauharnois region in Canada. Our service email is sent through Resend, in the United States. The full list of sub-processors, with what each one does, is in section 4 of the Data Processing Agreement, and we give at least 30 days’ notice before adding or replacing one.

How it is protected

These are the measures section 6 of the Data Processing Agreement commits us to:

• Encryption in transit with HTTPS and HSTS.
• Passwords stored only as salted hashes, with rate-limited sign-in.
• One-time sign-in links by email that work once, for 15 minutes, checked against a one-way hash.
• Browser push addresses, directory links and pending calendar invitations encrypted in the database.
• Role-based access: every request is checked against the person’s venue membership, every query is limited to their venue, and automated tests check that one venue cannot reach another.
• Signed, expiring links for claims, lost-item reports and My vFound pages, and an owner or manager can also reset a My vFound link. Checkroom tickets and visitor passes open only at their long random address.
• People-list email addresses shown in full only to owners and managers.
• A content security policy, bot protection on public forms and rate limiting.
• An audit log of security-relevant actions, kept for 24 months.
• Daily backups kept for 30 days, with encrypted copies also kept off the server in OVHcloud’s Beauharnois region in Canada, and restores that we rehearse.
• Least-privilege access for our own staff.

What we will not do

We do not sell the data, use it for our own marketing or use it to train AI models. vFound Visitors never stores an ID document image or number and performs no automated document verification, facial recognition or watchlist screening. The public site uses no advertising trackers.

If something goes wrong

We will tell you without undue delay after becoming aware of a personal data breach affecting data we process for you, with what we know about what happened, the data and people affected, the likely consequences and the steps taken. You can also see whether each product and its main features are working right now, their record for the last 90 days and any incident notes, on our status page.

Your controls

Owners and managers can export items, claims, parcels, visits, equipment checkouts, checkroom tickets and the people list, and correct or delete a guest’s personal details. To close the account, email us and we close it for you. After closing there are 90 days to download those records or ask us to reopen, and then the data is deleted.