Security

What we do to protect your account and messages — and what we do not do yet.

Your data

The database is hosted on Supabase (PostgreSQL) with encryption at rest.
Message text is removed 30 minutes after a message is sent or received, and the record itself after 24 hours.
Message text is not end-to-end encrypted today: our server can read it during those 30 minutes so it can deliver it, show it in your inbox and draft AI replies.
Every record belongs to one workspace, and every query is filtered by workspace, so one customer cannot see another's data.

Passwords are handled by Supabase Auth; we never see them.
API keys are shown once and stored only as a SHA-256 hash. Keys can be revoked or given an expiry date.
Your Gemini key is encrypted with AES-256-GCM before it is stored and is only decrypted to call Gemini for your messages.
Each paired phone has its own key, revoked automatically when you unpair the phone.

The portal, API and Android app talk over HTTPS. Release builds of the app refuse plain HTTP.
Webhooks are signed with HMAC-SHA256 using a secret per endpoint, and are only sent to public HTTPS addresses.

Rate limits on every API key, on unauthenticated endpoints and on phone pairing.
Premium-rate numbers are blocked, and new workspaces have a small sending limit for their first day.
STOP and UNSUBSCRIBE replies opt the sender out automatically.

Please report security issues privately to vrvertex.pk with steps to reproduce. We will acknowledge your report and keep you updated while we fix it.

Supabase — database and sign-in.
Google Firebase Cloud Messaging — wake-up notifications to your phone (no message text is sent through it).
Google Gemini — only if you add your own key; called with your key for your messages.
Your mobile carrier — delivers the SMS from your phone.