How vDPO protects your account and your clients' data.
1. Real-client data
- Encryption at rest: for real clients, checklist notes and the company registration number (CIN) are encrypted in the database with AES-256-GCM.
- A key for each client: every real client has its own data key, which is itself encrypted with a master key kept outside the database. Deleting a client deletes its key.
- Ownership checks: every request for client data is checked against the signed-in account that owns the client.
- Backups: real-client backups are password-protected ZIP files (AES-256). Each file inside is fingerprinted, so a changed backup is refused on restore. Backups contain your progress, not vDPO's control text.
- Audit trail: every backup download and restore is logged with the account, time and IP address.
- Uploads: document uploads are switched off for real clients until encrypted file storage is available.
2. Accounts
- Passwords are stored only as bcrypt hashes; we cannot see them.
- Repeated failed sign-ins are slowed down and temporarily locked.
- Password-reset links are single-use, stored only as hashes, expire after 60 minutes and are rate-limited.
- Sessions use secure, HTTP-only cookies, and every form is protected against cross-site request forgery.
3. The website
- All traffic is encrypted with HTTPS.
- A strict content security policy limits which scripts can run and where data can be sent. Fonts and scripts are served from vdpo.org; there are no analytics or advertising trackers.
- Configuration, database and system folders are blocked from web access.
4. Payments
Payments are handled by Razorpay. Card, UPI and bank details are entered in Razorpay's checkout and never reach vDPO's servers. Every payment is verified with Razorpay's signature before anything is delivered.
5. vDPO Proof
Files are fingerprinted inside your browser and never uploaded. Only the fingerprint is recorded on the blockchain.
6. Reporting a security issue
If you find a security problem, please email team@vdpo.org with the details and give us reasonable time to fix it before sharing it publicly. Please do not access other people's data or disrupt the service while testing.