── Security
Your data stays yours.
How Vlozi handles the parts of your business it touches: where data lives, how it's encrypted, who can read it, what happens if something goes wrong.
Encrypted in transit and at rest.
TLS 1.3 on every connection — Cloudflare terminates at the edge, then re-encrypts to origin. Database storage at rest is encrypted by Neon. Secrets live in Cloudflare Workers env, never in code.
Tenant-scoped — no shared rows.
Every record carries a `tenant_id`. Every query filters on it. There is no admin path that crosses tenants. API keys are tenant-scoped; sessions are tenant-scoped; uploads land in tenant-scoped storage prefixes.
Your content never trains a base model.
Vlozi's Content Engine runs inference on isolated context stores per tenant. Your blog posts, newsletters, and chat transcripts are used to answer questions about your business — never to improve a base model that other tenants benefit from.
Auth posture.
Password + email-verified accounts. MFA available on every plan. JWT-based session tokens with short TTLs and rotation on suspicion. Per-tenant API keys are minted in-dashboard, scoped, and revocable in one click.
── Sub-processors
Where Vlozi runs.
── Data lifecycle
Backups, retention, export.
- — Continuous WAL backups via Neon; point-in-time recovery within the retention window of your plan.
- — Full markdown export of blog content + CSV export of subscribers + media bundle export, anytime, dashboard-driven.
- — Cancel a paid plan: pack credits stay; subscription credits drain at cycle end; data stays readable + exportable for 30 days, then archived for 60 days, then permanently deleted unless the law requires retention.
── Responsible disclosure
Found something? Tell Vlozi quietly first.
Email [email protected] with details. Vlozi acknowledges in one business day, ships a fix proportional to impact, and credits you in the changelog if you want public credit.
No bounty programme today; do not test against tenants you don't own; do not exfiltrate data beyond what's needed to demonstrate the issue.
Compliance posture (GDPR, India DPDP) is being formalised — see the privacy policy for current data-handling commitments, and the changelog for what shipped this cycle.