1. Credentials are sealed
Marketplace access keys are encrypted the moment they arrive, before they are stored. They are never displayed again — not to you, not to our team.
2. Your data is yours alone
Every record is scoped to the account that owns it and enforced at the database layer, not only in the application. Agency seats see the agency’s work and nothing else.
3. Payments are verified
Payment notifications are cryptographically signed and checked before anything is credited, and every payment is applied exactly once.
4. Everything is recorded
Privileged actions are written to an append-only audit trail that cannot be edited or deleted. Suspicious activity — failed sign-ins, refused signatures, unauthorised access attempts — is logged and reviewed.
5. Secure by default
Sessions live in secure, HTTP-only cookies. All traffic is encrypted in transit.
- ✓Strict transport security and modern security headers on every page
- ✓Single sign-on available through Ventureship
- ✓Password reset links that expire and work once
6. Report a vulnerability
If you believe you have found a security issue, contact us through the contact page with the subject “Security”. We read every report and will never take action against good-faith research.
Questions about this document?
Get in touch and a person will answer. We would rather clarify than have you guess.
Contact us →