Trust
Security & Platform
Last updated: 8 July 2026
This page describes the security controls currently enabled in Vuneli and the shared responsibility between Verde IQ (app owner), the underlying Lovable Cloud platform, and you (customer). This is not a certification.
1. Hosting and platform
Vuneli runs on Lovable Cloud, which provides managed PostgreSQL, authentication, storage, and serverless functions. Traffic is served over HTTPS with TLS terminated at the edge. Data is stored in EU regions where offered by the underlying provider.
2. Authentication and access
Accounts use email + password with bcrypt-hashed credentials, or OAuth (Google, Apple) when enabled. Session tokens are issued as short-lived bearer tokens. Roles are stored in a dedicated user_roles table and checked server-side; admin actions require an explicit role grant.
3. Data isolation
Every user-facing table has PostgreSQL Row-Level Security enabled with policies scoped to auth.uid(). Sub-processors do not have direct read access to customer data outside their processing purpose.
4. Payments
Card data never touches Vuneli servers — it is handled by Stripe (PCI-DSS Level 1). Webhooks are HMAC-verified before any state change.
5. Backups and availability
The database is backed up daily by the platform provider with point-in-time recovery. We do not currently publish an availability SLA; contact us for enterprise commitments.
6. Sub-processors
Current sub-processors:
- Lovable Cloud — hosting, database, authentication, storage (EU where available).
- Stripe Payments Europe, Ltd. — card processing and tax calculation for EU/EEA customers.
- Resend — transactional email delivery.
- Lovable AI Gateway — AI inference for insights and document parsing.
7. Reporting a vulnerability
Please email samuel@stauniverse.tech with a description and reproduction steps. We aim to acknowledge within 3 business days. Please do not run automated scans against production or access data that is not your own.
8. Shared responsibility
Verde IQ maintains application code, access controls, and vendor selection. Lovable Cloud maintains platform-level security. You are responsible for account credential hygiene, choosing who has access inside your organization, and the accuracy of the data you upload.