Trust & Security
Security standards for enterprise visitors
HTTPS/TLS, modern browser protections, and privacy controls aligned with US and Indian expectations for commercial websites.
Transport security (SSL/TLS)
- All production traffic is served over HTTPS with publicly trusted certificates (typically issued via the hosting/CDN edge, e.g. Vercel + Cloudflare).
- HTTP requests are redirected to HTTPS (308) in production.
- HTTP Strict Transport Security (HSTS) is enabled in production with a long max-age, includeSubDomains, and preload eligibility.
- TLS 1.2+ is required; TLS 1.3 is preferred at the edge. Weak ciphers are disabled by the platform defaults.
Application security controls
- OWASP-aligned headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP.
- Admin authentication with hashed passwords (bcrypt), JWT sessions, and role-based access control.
- Rate limiting on public APIs; optional reCAPTCHA on lead forms.
- Input validation (Zod) and HTML sanitization for user-supplied content.
Privacy & consent
- Cookie consent before analytics/marketing tags (India DPDP Act 2023 + US CCPA/CPRA choice).
- See our Privacy Policy and Cookie Policy.
Responsible disclosure
Report security issues to support@vynelixai.com. Do not open public issues for undisclosed vulnerabilities. Researchers can also use /.well-known/security.txt.
For deployment TLS checklist details, see the project's COMPLIANCE and SECURITY documentation in the repository.