Security

Last updated 1 October 2026

Your photos

• Stored in private object storage. Nothing is public: your browser gets signed links that expire within an hour, and every link is checked against your account before it is issued.
• Uploads go straight from your browser to storage over TLS, are checked for type and size, and are decoded in an isolated worker before use.
• Originals are never modified. Deleting a photo or your account erases its files from storage within 24 hours.

Your account

• Sign-in runs on Neon Auth: passwords are stored only as salted hashes and never reach our logs. Sign-in is rate limited and failed attempts are logged.
• Sessions are HTTP-only, secure cookies, checked against the session store on every request, so “Sign out everywhere”, a password change or deleting your account ends them at once.
• Email confirmation codes and password reset links are single-use and expire after 15 minutes.

Our infrastructure

• TLS everywhere, strict security headers (HSTS, a content security policy, no framing), and no third-party scripts in the app.
• Data is hosted in the EU (Frankfurt) by Neon: the database only accepts TLS connections with a verified certificate and strong credentials, row-level security blocks every role but the app, and every query is scoped to your account.
• Security events are kept in an audit log with IP addresses stored only as keyed hashes. Backups are encrypted.

Report a vulnerability

Email support@vesold.com with details. Please give us reasonable time to fix an issue before disclosing it, and do not access other users’ data. We will not take legal action against good-faith research that follows these rules.