Security

• Row-level security on every database table. A user from one organisation cannot read, write, or infer the existence of another organisation’s data — even by crafting the HTTP request by hand.
• Password hashing with bcrypt, salted per-user. We never store or log plaintext passwords.
• Rate limiting on login — five failed attempts in fifteen minutes locks the account for fifteen minutes. Prevents credential-stuffing attacks.
• Per-user device limits, enforced on sign-in. Default is one active device per user; raising it is an admin-only action.
• New-device email alerts whenever your account is signed in from a browser we haven’t seen before.
• Transport encryption everywhere. HTTP Strict Transport Security with a two-year max-age.
• Content Security Policy restricting what third-party resources the dashboard can load. Protects against stored-XSS even if we miss an input sanitisation bug.
• Signed URLs for every panorama download. A customer tour’s images cannot be hot-linked outside the viewer page.

Online payments are handled by Razorpay on its own secure checkout. Your card, UPI or net-banking details are entered there and go directly to Razorpay, a payment aggregator that operates to PCI DSS standards. They never pass through, and are never stored on, VPV’s servers.

• Full screen-recording prevention. No browser can fully stop a determined person from recording their own screen. We make it harder (page blackout on visibility change, viewer-fingerprint watermark on every frame, no save/print shortcuts), but we don’t claim we’ve solved it.
• Independent SOC 2 audit. Not yet. We’re transparent about where our controls stand today; a formal audit is on the roadmap once the paid tier launches.

Email security@myvpv.com. We respond within two business days. Please don’t publicly disclose a vulnerability until we’ve had a chance to patch it; we commit to patching within 30 days of a confirmed report, and we credit researchers who want to be named. Related reading: Privacy Policy and Terms & Conditions.