What we do today. What we have not done yet.
This page is the honest version. VantaSupport is built by a two-person team in early access. We will not claim a SOC 2 we have not earned or a 24/7 on-call we do not staff. Here is what is actually in place, what is on the roadmap, and how to reach us if you find something wrong.
The practices that actually exist today.
Everything in this section is either enforced by managed infrastructure we use or by code we have written. Nothing here is aspirational.
Encryption
- TLS 1.2 or higher for every connection between you, our servers, and our sub-processors, enforced at the edge by our Caddy reverse proxy with automatic HTTPS.
- OAuth tokens and other secrets are encrypted with AES-256-GCM, and off-site backups are encrypted. We run our own PostgreSQL and Redis rather than third-party managed data services.
- Discord bot tokens are encrypted before they touch the database. Plain-text tokens never get written to logs.
Network and hosting
- Hosted on a dedicated virtual private server. The database and cache are bound to a private internal network with no public ingress.
- TLS terminates at our Caddy reverse proxy; only the proxy is exposed to the public internet.
- Secrets are supplied through environment configuration and held in memory; the token-encryption key is never written to logs.
Code and dependencies
- TypeScript end to end, strict mode, no `any` in production paths.
- Static analysis (ESLint, type checking) and dependency scanning run in CI on every change.
- Renovate-style automated dependency updates with the security advisory feed.
Access
- Today the engineering team is one person (Hydra). Production access is single-name and protected with two-factor authentication.
- Every production action is recorded in an append-only audit log that any future teammate inherits read access to.
- OAuth scopes from Discord are minimal: identify, email, and guilds. We never request bot administrator or message intent we do not use.
Data handling
- Sub-processors are listed in plain text in our DPA and Privacy Policy. We will email customers thirty days before any change.
- AI providers (OpenAI, Anthropic) operate under contract terms that prohibit training their foundation models on customer prompts.
- You can request export or deletion of everything your server has stored at any time by emailing privacy@vantasupport.com; we action it within thirty days.
Backups and recovery
- Encrypted automated backups taken daily to off-site object storage (Cloudflare R2) on a rolling fourteen-day window.
- Documented restore procedure. We have done a successful test restore. We are not yet promising an SLA-grade RPO or RTO.
- Service-side rate limits and per-server quotas prevent a runaway dependency or abuser from taking down other tenants.
The honest list.
Things you might expect to see and the reason they are not here. Most are a question of stage, not principle. We would rather under-promise than ship a security page that reads like an audit report we never sat for.
- SOC 2 audit. It costs more than we can justify pre-revenue. On the roadmap when we cross a reasonable customer threshold.
- ISO 27001. Same reasoning.
- Formal third-party penetration test. We rely on automated scans today and will commission one before we accept enterprise contracts.
- A 24/7 on-call rotation. We respond during business hours and best-effort outside them. The status page is the source of truth for incidents.
- A funded bug bounty program. We will credit researchers publicly and add cash rewards once we have revenue to fund them.
- A published PGP key for security@. We will generate and publish one before we encourage encrypted reports.
What our legal docs commit to.
Compliance for us is the work of doing the right things in the product and writing them down. Read the documents below if you are evaluating us for vendor risk.
Lawful basis, data subject rights, sub-processor list, breach notification, and international transfer terms are all set out in our Privacy Policy and DPA.
Read the Privacy Policy →California rights to know, delete, correct, and opt out are honored. We do not sell or share personal information, and we treat Global Privacy Control signals as a valid opt-out.
CCPA section →A complete data processing agreement with sub-processor list, security measures, SCCs, and breach notification SLA. No countersignature required to be bound by it.
Read the DPA →Security questions, answered.
Where is data stored?
On our own PostgreSQL on a dedicated virtual private server, with encrypted backups to Cloudflare R2. AI prompts go to our AI providers (OpenAI for embeddings, Anthropic for replies) in the United States under contractual terms.
Is the bot token encrypted?
Yes. On the Premium plan you bring your own Discord bot token. It is encrypted before it is written to the database, decrypted only in memory when the bot connects to Discord, and never written to logs.
Do you use customer data to train models?
No. Our contractual terms with each AI sub-processor prohibit training on customer prompts, and we do not derive training datasets from your messages on our own side either.
Who has access to production?
Today, one person: Hydra, the engineering co-founder. Access is protected with two-factor authentication and every action is logged. As the team grows we will add named roles, and the access boundaries already exist in the audit log to enforce that.
How do I report a vulnerability?
Email security@vantasupport.com with the details. We will triage and acknowledge within one business day. Good-faith research is covered by the safe harbor clause in our Terms of Service.
Can I get a security questionnaire response?
Yes, but the honest version. We will answer your vendor questionnaire with what we actually have in place today and what is planned. We are not going to claim a SOC 2 we have not earned.
Found something?
We want to hear about it. Good-faith research is protected by the safe harbor clause in our Terms of Service. We do not yet run a funded bug bounty program, but we will credit you publicly with your permission and we plan to add cash rewards as the company can support them.
- Initial acknowledgement within one business day.
- Best-effort patch timelines: critical in days, high within two weeks.
- We will not pursue legal action against good-faith researchers who follow the policy.