How vFound looks after your data
Venues trust vFound with guests’ names, photos of their belongings, parcels, visitors and signatures. This page summarises how we protect that data. The Data Processing Agreement and the Privacy Policy are the binding versions, and they win if anything here differs.
Where your data lives
The application, database and files are hosted by OVHcloud in Singapore, including our own mail server, which sends service email. The full list of sub-processors, with what each one does, is in section 4 of the Data Processing Agreement, and we give at least 30 days’ notice before adding or replacing one.
How it is protected
These are the measures section 6 of the Data Processing Agreement commits us to:
- Encryption in transit with HTTPS and HSTS.
- Passwords stored only as salted hashes, with rate-limited sign-in.
- Browser push addresses, directory links, pending calendar invitations and Slack bot tokens encrypted in the database.
- Role-based access: every request is checked against the person’s venue membership, every query is limited to their venue, and automated tests check that one venue cannot reach another.
- Signed, expiring links for guests’ private pages.
- A content security policy, bot protection on public forms and rate limiting.
- An audit log of security-relevant actions, kept for 24 months.
- Daily backups kept for 30 days, an encrypted copy kept off the server, and restores that we rehearse.
- Least-privilege access for our own staff.
What we will not do
We do not sell the data, use it for our own marketing or use it to train AI models. vFound Visitors takes no ID scans and no visitor photos. The public site uses no advertising trackers.
If something goes wrong
We will tell you without undue delay after becoming aware of a personal data breach affecting data we process for you, with what we know about what happened, the data and people affected, the likely consequences and the steps taken. You can also see whether vfound.io is up right now, and its record for the last 90 days, on our status page.
Your controls
Owners and managers can export items, claims, parcels, visits and the people list, correct or delete a guest’s personal details, and close the account. After closing there are 90 days to download or reopen, and then the data is deleted.
Frequently asked questions
Where is vFound hosted?+
On OVHcloud servers in Singapore, including our own mail server. The Data Processing Agreement lists every sub-processor.
Does vFound have ISO 27001 or SOC 2 certification?+
No. We do not hold those certifications. The security measures we commit to are listed in section 6 of the Data Processing Agreement.
Is AI trained on our data?+
No. vFound does not use your data to train AI models, and you can switch vFound AI off for your venue.
Who do I contact about security?+
Email armaan@vfound.io.
See it with your own desk.
Start your 14-day free trial. A valid card is required; cancel before day 14 to avoid the yearly charge.
Start your 14-day free trial