Security & Platform

Vuneli runs on Lovable Cloud, which provides managed PostgreSQL, authentication, storage, and serverless functions. Traffic is served over HTTPS with TLS terminated at the edge. Data is stored in EU regions where offered by the underlying provider.

Accounts use email + password with bcrypt-hashed credentials, or OAuth (Google, Apple) when enabled. Session tokens are issued as short-lived bearer tokens. Roles are stored in a dedicated user_roles table and checked server-side; admin actions require an explicit role grant.

Every user-facing table has PostgreSQL Row-Level Security enabled with policies scoped to auth.uid(). Sub-processors do not have direct read access to customer data outside their processing purpose.

Card data never touches Vuneli servers — it is handled by Stripe (PCI-DSS Level 1). Webhooks are HMAC-verified before any state change.

The database is backed up daily by the platform provider with point-in-time recovery. We do not currently publish an availability SLA; contact us for enterprise commitments.

Current sub-processors:

Please email hello@vuneli.com with a description and reproduction steps. We aim to acknowledge within 3 business days. Please do not run automated scans against production or access data that is not your own.

Verde IQ maintains application code, access controls, and vendor selection. Lovable Cloud maintains platform-level security. You are responsible for account credential hygiene, choosing who has access inside your organization, and the accuracy of the data you upload.