Security at Verstavo
Verstavo helps commercial-real-estate credit professionals read risk in public and private loan data. Trust in how we handle your data is a precondition for that work. This page summarizes the controls we operate — and what we're still building.
Hosting & infrastructure
- Verstavo runs on Render, a SOC 2-audited cloud platform, with a managed PostgreSQL database. We operate no physical servers — physical and network security are provided and independently attested by our infrastructure provider.
Encryption
- In transit: all traffic is served over TLS / HTTPS. We do not offer unencrypted access.
- At rest: the database and its backups are encrypted at rest by our infrastructure provider.
- Enforced by the browser: we send HSTS (one year, including subdomains), so once your browser has seen the site it refuses to connect to us over plain HTTP at all — even if a link, a bookmark or an attacker asks it to.
Authentication & access
- Passwords are stored using argon2id, a modern, deliberately slow password hash — never in plaintext, never a fast hash, never in logs.
- Multi-factor authentication (TOTP) is enforced for administrative accounts.
- Access is role-based and organization-scoped: you can reach only your own organization's data.
- Sessions are hardened (HTTPS-only, HttpOnly, SameSite, finite lifetime), and authentication endpoints are rate-limited.
- Pages carry a content security policy — an allowlist, not a filter: the browser refuses anything from an origin that is not on it, and the site refuses to be embedded in a frame on any other website. Every JavaScript library we run is served from our own domain, never a third-party CDN. The allowlist's exceptions are named here rather than left to be discovered: Google Fonts serves our web fonts, Stadia Maps serves map tiles, OpenStreetMap's Nominatim turns a street address into a map coordinate, and our public marketing pages only carry the LinkedIn Insight Tag for advertising measurement — it is not present inside the application. What that tag does, and how to refuse it, is in Privacy §2 and §7.
- Administrative and database access is limited to authorized personnel under least privilege.
Your data, and how we use AI
Your portfolio data stays inside our infrastructure. Customer portfolio holdings are not sent to any AI / model provider. AI-assisted features operate on public market and regulatory data only.
One exception, named rather than left to be found: when you open the map on a portfolio loan, your browser asks OpenStreetMap's Nominatim to turn that property's street address into a coordinate. The address is the whole of that request — no balance, borrower, NOI, valuation or portfolio name is in it, and nothing about the loan is stored there. Not opening the map avoids it entirely.
- Your data is yours. We do not sell it, and we do not share it with third parties for their own use.
- We do not use your data to train any AI model. Our AI features run on the Anthropic (Claude) API under commercial terms, and Anthropic does not train on data submitted via the API.
- Any future AI feature over portfolio data would send only aggregated, de-identified statistics — never a property's name, address, or location — and only under a data-processing agreement with zero data retention.
- We minimize the personal data we collect — an account name and email.
Secure development & change management
- All code is version-controlled; changes ship through pull requests with required automated review and status checks before reaching production.
- Secrets are stored in our provider's secret store — never in source code.
- Database access uses parameterized queries; passwords are never logged.
Availability & continuity
- Our managed database is backed up automatically by our infrastructure provider.
- We maintain and test recovery procedures for restoring service from backup.
Compliance & roadmap
- We are actively working toward SOC 2 Type II in progress across the Security, Availability, and Confidentiality criteria — a readiness assessment and control program are underway.
- A Data Processing Addendum is available on request.
- A current subprocessor list (Render, Stripe, Anthropic, GitHub, Google Workspace) is available on request.
- Payments are processed by Stripe; card data never touches Verstavo's systems.
Reporting a security issue
Found a vulnerability or have a security concern? Please reach us through our contact page. We investigate every report and appreciate responsible disclosure.