Security & Compliance

Every record in Vectrox carries the identifier of the workspace that owns it, and PostgreSQL Row Level Security (RLS) policies on every tenant table compare that identifier with the authenticated identity of the person making the request (auth.uid()) and the workspaces they belong to. A query that omits a workspace filter still returns only the requester's own rows: the database engine applies the policy beneath the application, so a defect in a screen cannot disclose one customer's data to another.

• RLS policies enforce both the workspace boundary and the role and team scope within it, and every server action re-validates the session before it runs.
• Integrity triggers refuse any record that references another workspace's client, deal, asset or team member, so cross-tenant links cannot be written even by a malformed request, and a record can never be moved into another workspace.
• The anonymous database role has no access to tenant data. Scheduled jobs and payment webhooks run on the server with elevated credentials and scope every query to a single workspace in code.
• Documents are stored under workspace-prefixed keys (workspace/client/object). Downloads are issued as signed links valid for 60 seconds, and uploads as pre-signed requests valid for 5 minutes for one exact key, file type and size, verified once the upload completes.
• Every document download is recorded in the audit trail.

Access is governed by exactly five roles, Owner, Admin, Manager, Member and Viewer, with no custom roles to drift out of policy. Visibility is enforced by the database itself, not only by the interface: nothing in the application can present a person with data their role does not permit.

• Managers see their own accounts and those of their direct reports. Squad leads, who must hold the Manager role or above, see the accounts of everyone in the squads they lead.
• Members work only the accounts assigned to them, unless the workspace or squad visibility mode (Strict, Squad Shared or Open) deliberately widens it. An unassigned client is visible only to the Owner and Admins.
• Viewers are read-only: they cannot create, edit, delete or export records, and they do not receive analytical risk scores.
• Administrative locks: the business profile, tax registrations, document and invoice defaults, product catalog, templates, workflows, team membership and the audit log are restricted to Owners and Admins. Only the Owner may invite an Admin or manage the subscription.
• Workspaces are registered with a verified corporate email address; free and disposable mailboxes are declined. Owners and Admins can review the workspace's recent sign-ins, with time, IP address, device and, where available, location.

The audit trail is written by triggers inside the database, so a change cannot bypass it by taking a different route through the application. Each entry records the acting user's identifier and email, the action, the affected entity and record, a summary, and for updates and deletions a field-by-field record of the values before and after the change.

• Coverage includes record creation, updates and deletions, data exports, role and team changes, bulk deletions, document downloads, configuration changes and the use of AI features.
• Signed-in users hold read-only privileges on the audit table, with all write privileges revoked: no user, Administrators included, can insert, edit or delete an entry.
• Owners and Admins can search and filter the log in Settings, and export it to CSV for internal governance reviews and external auditors.
• Audit records are retained for the life of the workspace and are removed only as part of a confirmed workspace closure.

All traffic is served over HTTPS with TLS 1.2 or higher. Strict Transport Security is enforced for two years across all subdomains and the domain is eligible for browser preload lists, so browsers refuse unencrypted connections outright.

• At rest: databases, backups and stored documents are encrypted with AES-256 by our database and storage providers.
• Credential vaulting: mailbox access tokens, custom mailbox (IMAP and SMTP) passwords, and Slack and Notion credentials are additionally encrypted with AES-256-GCM before they are stored, and are decrypted only on the server.
• Passwords are never stored in readable form.
• Browser hardening: a Content Security Policy, framing disabled (frame-ancestors 'none'), MIME-type sniffing disabled and cross-origin window isolation on every response.

Vectrox does not use your data to train, retrain, fine-tune or evaluate any artificial intelligence model, its own or a third party's, and engages its AI provider only on business terms under which requests and responses are excluded from model training. This undertaking is made contractually in clause 4 of our Privacy Policy.

• Nothing is sent for AI processing unless a person uses an AI feature, and only the text that feature needs is sent. Processing is transient: no separate copy of the request or response is retained.
• Executive briefings refer to accounts by reference code only; client names and contact details are not sent. Our servers then insert every figure from your records, and any reference the model was not given is discarded.
• Health scores, lapse probabilities and forecasts are calculated by deterministic models on our servers, never by the AI.
• AI output is a recommendation: nothing it proposes is saved or sent without a person choosing to.

For the data a customer keeps about its own clients, the customer is the controller (Data Fiduciary under India's Digital Personal Data Protection Act, 2023) and Vectrox acts as its processor (Data Processor), on documented instructions only. For the accounts of the people who sign in, Novix Technologies is the controller.

• A Data Processing Addendum governs processing on the customer's behalf, including Standard Contractual Clauses for international transfers and notice of a personal data breach within 72 hours.
• Sub-processors are bound under strict written data protection agreements. An active vendor register is available to enterprise compliance teams upon request, and customers receive at least 14 days' advance notice before a new sub-processor begins processing customer data.
• A deleted record is removed from the live database immediately. On a confirmed request from the workspace Owner, the entire workspace, including documents, mailbox tokens and audit records, is permanently deleted within 30 days; provider backups are overwritten in their normal cycle.
• Individuals' rights of access, correction, erasure and portability, and grievances under the DPDP Act, are handled by the Data Governance & Grievance Desk within 30 days.