Tenant-scoped access
Authenticated requests resolve a company context before protected data is accessed.
Security
Clear controls and clear responsibilities.
This page summarizes controls visible in the current product. A customer-specific security or data-processing review is available on request.
No third-party certification is currently claimed.
Permissions
Roles, effective permissions, subscription state, and feature gates protect supported operations.
Signed ingestion
Lifecycle events use per-company HMAC-SHA256 signatures over the exact request body.
Protected identifiers
Supported fields use configurable encrypted or hash-only storage behavior.
Data handling
Storage policy is set by field.
Designated fields support AES-256-GCM encryption or keyed HMAC-SHA-256 hash-only storage. Displayed values are code defaults, not a customer’s live configuration.
- encrypted
- phone
- encrypted
- ipAddress
- encrypted
- deviceFingerprint
- encrypted
- paymentFingerprint
- encrypted
- customerName
- encrypted
VertexY handles
Product authentication, tenant boundaries, supported permission checks, configured storage behavior, and assessment records.
Customers handle
Lawful data collection, secret storage, retention choices, fallback behavior, customer communication, and final business decisions.
Security review
Contact us for current security, privacy, or data-processing material. Never send credentials, tokens, signing secrets, or raw customer data by email.