Last updated October 2026. A plain account of what's actually true today — we'd rather this page be short and accurate than long and padded.
Every connection to Vantage Capture is HTTPS, enforced with HSTS so a browser won't even attempt an unencrypted request. Our database runs on Neon, a managed PostgreSQL provider that encrypts data at rest and requires an encrypted connection for every query.
Passwords are hashed with bcrypt — we never store them in plain text, and nobody at Vantage Capture can read yours. Login attempts are rate-limited, and we compare passwords in a way that doesn't leak which emails have accounts through response timing. Sessions are capped at 3 signed-in devices at a time, and changing your password immediately signs out every other device — not on their next refresh, right away.
Card details go straight to Stripe's own hosted checkout — they never pass through Vantage Capture's servers or database. We only store a Stripe customer reference and your subscription status, never a card number.
Every request that reads or changes your data is checked against your signed-in account — there's no endpoint in the app that lets one account reach another's items, jobs, or client details by guessing an ID. This is enforced on every request, not just in the interface.
Login, password reset, and every endpoint that creates data or costs us money to run (AI classification, email sending, billing) is rate-limited per account, so a compromised login or a scripted attack can't run unbounded against your account or ours.
A failed payment, an unexpected cancellation, or a chargeback pages us by email in real time. A daily automated check confirms our database and payment processor are actually reachable, and flags any account stuck in a bad billing state for days with no one aware.
We haven't commissioned a third-party penetration test or a formal compliance audit (SOC 2, ISO 27001) — we'd rather say that plainly than imply otherwise. What's on this page is real and something we've verified ourselves, not a certification.
Found a security issue? Email support@vantagecapture.app with what you found and how to reproduce it. We'll respond, and we won't pursue legal action against a good-faith report that doesn't access, modify, or retain data beyond what's needed to demonstrate the issue.