Security
Last updated 8 September 2026
Security is a product requirement at Vizzorah, not an afterthought. Here is how the platform is protected and how to reach us with a concern.
Encryption
All traffic is served over TLS. Data is encrypted at rest in our managed database and file storage.
Access control
Every record is protected by row-level rules enforced in the database itself, so a client can only ever read their own bookings, messages and invoices, and a vendor only their own business data.
Authentication
Sign-in is handled by a managed identity provider with hashed credentials, session expiry and support for social sign-in. Administrators hold a separate role that is granted explicitly.
Payments
Card data never touches our servers. Payment records held on the platform contain amounts and references only.
Auditing
Sensitive tables write an append-only audit trail of who changed what and when, reviewable by administrators.
Backups
The database is backed up continuously with point-in-time recovery, and restores are tested periodically.
Reporting a vulnerability
Email security@vizzorah.com with steps to reproduce. We acknowledge within two working days and will not pursue researchers who test in good faith, avoid privacy violations and give us reasonable time to fix.