Security

Organizers and vendors trust us with their sales data. Our approach starts with holding as little as possible, and then protecting what we do hold.

What we never touch

• Money. Vauren never receives, holds or moves funds. Booth fees go straight to the organizer by Interac e-Transfer.
• Card numbers. We never receive or store card numbers. Card payments stay entirely inside the vendor’s card machine provider.
• Write access. Card machine connections are read-only. Vauren cannot take payments, issue refunds or change anything in a vendor’s account, and a vendor can revoke access at any time.

How we protect data

• Hosted in Canada. Our application and database run in Montréal data centres operated by established cloud providers.
• Encrypted in transit and at rest. All traffic uses HTTPS with HSTS. Data is encrypted at rest by our database provider, and card machine access tokens are additionally encrypted with AES-256-GCM.
• Passwords and links. Passwords are hashed with bcrypt. Vendor invite links are stored only as one-way hashes, so a database copy can’t be used to open them.
• Separation. Every request checks that an organizer can only see their own events and the vendors at them.
• Uploads. Proof files are size-limited and checked by file signature, not just by name.
• Browser protections. A strict Content Security Policy, clickjacking protection and secure, HTTP-only sign-in cookies.
• Least privilege. Production access is limited to the people who need it, and secrets are kept out of source code.
• Minimal data. We collect only what the product needs, and no analytics or advertising trackers.

On our roadmap

• Two-factor sign-in for organizers.
• An activity log of changes to fees and payouts.
• An independent security review as we grow.

If something goes wrong

If we learn of a breach that creates a real risk of significant harm, we will notify the people affected and the Office of the Privacy Commissioner of Canada as the law requires, and tell you what we are doing about it.

Report a vulnerability

If you think you have found a security problem, please email security@getvauren.com with the details. Please give us reasonable time to fix it before sharing it publicly, and don’t access or change other people’s data while testing. We will acknowledge your report and keep you updated, and we won’t take legal action against good-faith research that follows these guidelines.