Security

Last updated 19 October 2026

Vervoro runs the stock, orders and buyer details a seller's business depends on. These are the protections we build in, and how to report a problem.

How we protect data

• Separate companies. Each company's data is kept apart from every other company's, enforced by the database itself on every request.
• Encryption. TLS 1.2 or higher in transit, encryption at rest, and every buyer field encrypted on its own under a key unique to the seller's company. Closing a company destroys its key.
• Minimal buyer data. Only what is needed to ship, removed 30 days after delivery, and never written to logs, analytics or AI requests.
• Two-factor sign-in for everyone. Passkeys by default, or a password with an authenticator app. No codes by text message or email.
• No standing access. Our staff reach a company's data only through a time-limited, recorded grant that the seller sees and can end. Developers have no access to production data.
• Hosted in the EU. See our sub-processors.
• Testing and monitoring. Central security logs, monthly vulnerability scans, a yearly independent penetration test, quarterly access reviews and a written incident response plan.
• Safe marketplace connections. New connections start in shadow mode and send nothing until a seller makes them live. Vervoro never sets a seller's marketplace stock to zero unless the seller chose it.

Reporting a vulnerability

If you believe you have found a security vulnerability in Vervoro or this website, please email [email protected] with the details and the steps to reproduce it. We will acknowledge your report within 3 working days and keep you informed as we fix it.

While researching, please:

• use only your own accounts and test data, and never access, change or delete other people's data;
• avoid anything that degrades the service, such as denial-of-service testing, spam or automated scanning at high volume;
• give us reasonable time to fix the issue before you share it.

If you act in good faith and follow these guidelines, we will not pursue legal action against you for your research, and we will be glad to credit you once the issue is fixed. We do not currently run a paid bug bounty.

Our security.txt follows RFC 9116.