DATAVLTZ // Trust Center

Trust & Security

This page is maintained by the DATAVLTZ team to answer common security and privacy questions about the platform. It describes controls that are currently enabled — it is not an independent certification or audit report.

Authentication

Email + password and Google sign-in.
Leaked-password detection is enabled at sign-up and password change.
Anonymous sign-ups are disabled. Every state-changing call requires a real authenticated user.
Terms of Service acceptance is recorded per user with version + timestamp.

Access Controls

Row-Level Security is enabled on every user-facing table.
Users can only read and write their own vault data, balances, and ledger entries.
Privileged server functions require an authenticated session and reject anonymous callers.
The public ledger feed contains only aggregated settlement events — no user identifiers.

Data & Audit

All deposits, withdrawals, purchases, and royalty distributions are written to an append-only audit ledger.
Each event is stamped with a tamper-evident transaction hash that can be re-verified via the public Receipt API.
Data in transit is protected by TLS; data at rest is encrypted by the underlying cloud database.
Users can export their own data and revoke individual data streams at any time from their vault.

Platform

Hosted on Lovable Cloud, which runs on managed Supabase + Cloudflare infrastructure.
Backend secrets are stored in a managed secret store; never embedded in client code.
Database migrations are reviewed before they ship and are versioned in source control.
This is not a SOC 2 / ISO / PCI / HIPAA certification — it is a description of currently-enabled controls.

Security Contact

Report a vulnerability or suspected abuse: security@datavltz.com
General abuse reports: abuse@datavltz.com
We aim to acknowledge reports within 2 business days.

Policies

Last updated: September 5, 2026. Controls described here reflect the current production configuration and may change as the product evolves.