Security & Compliance

Enterprise-grade security built into every layer of our platform

VPC is built with a security-first architecture. We handle sensitive PII data with multiple layers of protection, from network isolation to application-level controls. Security is not a premium feature — it is our foundation.

Infrastructure Security

Network Isolation

  • Private subnets for database and application tiers
  • Public subnets for load balancers only
  • Network access controls and security groups for traffic filtering
  • No direct internet access to sensitive resources

Database Security

  • Encrypted at rest using managed encryption keys
  • Encrypted in transit with TLS 1.2+
  • Automated backups with point-in-time recovery
  • Deployed in private subnets, not publicly accessible

Container & Compute Security

  • Serverless container orchestration with automatic OS patching
  • Continuous container vulnerability scanning with automated deploy gating for critical and exploitable vulnerabilities
  • Runtime threat detection and monitoring on all production containers
  • Dependency scanning for application and OS-level vulnerabilities
  • Task-level access roles following least-privilege principles
  • Secrets management for API keys and credentials
  • Health checks and automatic failover

Load Balancer & Edge Security

  • CloudFront CDN with origin secret validation
  • WAF IP allowlist for development environments
  • TLS/SSL termination with managed certificates
  • HTTPS-only enforcement with HSTS preload (1-year max-age, includeSubDomains)
  • DDoS protection at the network edge

Application Security

Authentication & Authorization

  • Multi-factor authentication with an authenticator app (TOTP) and one-time recovery codes
  • MFA on by default for every account, always required for VPC staff, and always required for breach reports and exports
  • Brute force protection with automatic lockout
  • HttpOnly, Secure, SameSite cookies
  • CSRF protection on all forms

Web Security Headers

  • Nonce-based Content Security Policy (CSP) — no unsafe-inline
  • HSTS with preload (1-year max-age, includeSubDomains)
  • Clickjacking protection (X-Frame-Options)
  • MIME sniffing prevention
  • Referrer policy controls

Input Validation

  • File upload validation: size, type, and MIME checking
  • Rate limiting on file uploads (10/hour per user, 20/hour per IP)
  • XSS prevention through input sanitization
  • Path traversal protection on filenames
  • Parameterized queries to prevent SQL injection

Monitoring & Logging

  • Structured audit trail: 9+ sensitive operations logged with user, IP, timestamp, and action
  • Failed login tracking and security alerts
  • Infrastructure monitoring and uptime tracking
  • Error tracking and performance monitoring

Data Security & Privacy

Encryption

  • In transit: TLS 1.2+ for all connections (HTTPS, database, API)
  • At rest: AES-256-GCM authenticated encryption for uploaded files
  • Per-project encryption keys for uploaded files
  • ElastiCache with TLS encryption in transit
  • Secrets management for API keys and credentials

Data Retention & Deletion

  • VPC keeps the personal data in your project, encrypted, until you instruct us to delete it. Finishing a project does not delete it, and completed projects have no automatic deletion timer.
  • Your uploaded file is encrypted on arrival. The original file is deleted automatically when processing completes; the imported data is kept, encrypted, as described above.
  • VPC keeps the breach records its data providers return for each person, so results can be reproduced and you are not charged again for a search already run for your project.
  • On your written instruction, VPC deletes a project by destroying its encryption key. That makes the encrypted personal data unreadable, including in backups. To guard against mistakes, the key can be restored for 14 days; after that the deletion is permanent. Database backups roll off after 35 days.

Multi-Tenant Isolation

  • Per-tenant database schemas for complete data separation
  • Per-project tables within each tenant
  • Per-project encryption keys
  • Role-based access with tenant, company, and project permissions

Compliance & Standards

VPC does not currently hold SOC 2, ISO 27001, HITRUST or HIPAA certification.

Active

Encrypted Retention

Project data kept encrypted until you instruct us to delete it. Deletion destroys the project's key; recoverable for 14 days, then permanent.

Active

Secure Authentication

Argon2 password hashing, MFA (TOTP + recovery codes), brute-force lockout, session timeouts.

Active

OWASP Top 10 Aligned

Security controls aligned with the OWASP Top 10 2021 framework including CSP, input validation, and dependency scanning.

Planned

Penetration Testing

An independent penetration test is being arranged; a summary will be available to customers under NDA once it is complete.

Active

HSTS Preload

HTTP Strict Transport Security with preload list inclusion for all domains.

Active

Container Scanning

Continuous container vulnerability scanning with automated deploy gating. Runtime threat monitoring on all production workloads.

Incident Response

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. Please report security issues to our security team. We commit to acknowledging reports within 48 hours and providing fixes within 30 days for critical issues.

Breach Notification

In the event of a data breach affecting customer data, we will notify affected customers within 72 hours and provide a description of the incident, types of data affected, mitigation steps taken, and recommended actions.

Continuous Monitoring

All production systems are continuously monitored for security threats, vulnerable dependencies, and anomalous behavior. Our team is automatically alerted when issues are detected.

Best Practices for Users

Enable Multi-Factor Authentication

Keep multi-factor authentication enabled on your account, using an authenticator app (TOTP), and store your one-time recovery codes somewhere safe.

Use Strong Passwords

Use a minimum of 12 characters with a mix of upper/lowercase letters, numbers, and symbols.

Review Account Activity

Regularly check your account activity for any suspicious actions or unauthorized access.

Always Use HTTPS

Access VPC only via HTTPS. We set HSTS headers so your browser automatically upgrades to a secure connection.

Security Contact

For security-related inquiries, vulnerability reports, or compliance questions, contact our team.

security@validatepiiclasses.com