Security Overview

1. Introduction & Scope

This Security Overview explains, at a practical level, how Vexaro approaches the security of the Service and of the data Processed in connection with it. It is the entry point to the Vexaro Trust Center and is intended for the technical, security, and procurement teams who evaluate and operate the Service.

The scope of this document is the Vexaro-operated parts of the Service: our control plane (API, dashboard, and signaling), our managed connectivity (relay and failover), the storage and backup systems we operate, and the people, processes, and tooling around them. Where the Customer runs a Self-Hosted Deployment, the Customer operates the underlying infrastructure, and responsibility is divided as described in Section 10 and in the Self-Hosted Responsibility Matrix.

This document is informational and describes our program as it generally operates; it is not a warranty that the Service is free of vulnerabilities or that any particular outcome will be achieved. It does not create rights beyond those in your contract. If this document conflicts with an Order Form, the Order Form controls; otherwise the order of precedence in the Terms of Service applies. Defined terms used here have the meaning given in the Terms of Service.

2. Security Program

Vexaro operates an information-security program designed and operated to align with the principles of recognised information-security-management, service-organisation-control, and application-security-verification frameworks. The program is risk-based: we identify the assets and data we are responsible for, assess the threats to them, and apply administrative and technical controls proportionate to that risk. We rely on our hosting providers for the physical and environmental security of the facilities where our servers run (see Section 5).

The program is documented in internal policies and standards covering, among other areas, access management, secure development, change management, logging and monitoring, vulnerability management, backup and recovery, vendor management, and incident response. Security roles and responsibilities are assigned to accountable owners, security responsibilities are communicated to personnel, and personnel with access to production systems are subject to confidentiality obligations and to security awareness practices appropriate to their role. The program is reviewed and updated periodically and in response to material changes in the Service, our infrastructure, or the threat landscape.

This section describes a program, not a certification. For how we frame compliance and assurance, see Section 12.

3. Encryption

Vexaro encrypts data in transit, and selected sensitive data at rest, using widely deployed, standard algorithms.

• In transit: Vexaro uses widely deployed transport encryption appropriate to the relevant channel between Agents, applications, APIs, and media sessions. Traffic to Vexaro’s websites, API, and browser viewer is decrypted at the edge of Vexaro’s edge provider, which terminates TLS (see the Encryption Overview).
• At rest: Multi-factor authentication secrets; webhook, directory-connector, and single sign-on client secrets; and the email address in each account record are encrypted at rest, and database backups are encrypted. Other stored data, including the details and timelines of Recordings, is not encrypted at rest by Vexaro; recording files stay on the Customer’s computers.

Live session media is encrypted in transit and is not stored by Vexaro (Section 8). Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. When the viewer is a web browser, the session always uses the relay and a Vexaro server component (the browser bridge) opens the session media on the browser’s behalf, so browser-viewed sessions are not end-to-end encrypted against Vexaro. A fuller description of the media path, key handling, and what a relay can and cannot see is set out in the Encryption Overview.

4. Access Controls

Access to Vexaro production systems and to Customer data is governed by the principle of least privilege: personnel are granted only the access required for their role, and access is reviewed periodically and revoked promptly on role change or departure.

• Role-based access control (RBAC). Access rights are assigned through defined roles rather than to individuals ad hoc, both within our internal systems and as a feature offered to Customers in the Service.
• Multi-factor authentication (MFA) and server access. MFA is required for Vexaro staff accounts with platform-administrator rights in the Service. Administrative access to production servers uses key-based SSH from authorised machines over a private network.
• Least privilege and separation. Standing access to production data is minimised; elevated or break-glass access is limited, justified, and time-bound where used.
• Access logging. Administrative actions taken through the Service are recorded in its audit logs (see Section 7). Access at the server level is limited to the key-based access above and is not recorded in those audit logs.

Within the Service, the Customer administers its own users, roles, and policies, including RBAC and, where applicable, SCIM / directory provisioning, and is responsible for those configurations as described in Section 10.

5. Network & Infrastructure Security

Vexaro runs the Service on servers it operates at hosting providers, and applies layered controls at the network and infrastructure level.

• Segmentation. Production environments are logically separated from non-production environments, and internal network segmentation limits lateral movement and restricts access between components to what is required.
• DDoS protection and edge. Internet-facing endpoints may use edge, CDN, relay, and DDoS-mitigation providers appropriate to the relevant deployment.
• Hosting. Compute, database, and cache services run on servers that Vexaro operates at the hosting provider named in the Subprocessor List. Vexaro operates the database and cache services itself.
• Backups. We take nightly database backups to support recovery; backups are encrypted (see Section 3), and an encrypted copy is kept off the production server. Retention of backup data is described in the Privacy Notice.

The Subprocessors that host Vexaro’s servers and relays are listed in the Subprocessor List. For a Self-Hosted Deployment, the network and infrastructure controls in this section are the Customer’s responsibility (Section 10).

6. Application Security

Security is built into how the Service is developed and changed, not bolted on afterwards.

• Secure SDLC. Changes follow a defined development and change-management process that includes peer code review, version control, and testing before release to production. Security considerations are addressed across design, development, and deployment.
• Dependency and secret scanning. We scan code and dependencies for known-vulnerable components and for inadvertently committed secrets, and we manage remediation through our vulnerability-management process.
• Regular security testing. We perform security testing on a regular basis as part of our program. This is a description of the program, not a representation that the Service is free of vulnerabilities or defects.
• Vulnerability disclosure. We operate a vulnerability-disclosure channel so that researchers and Customers can report potential security issues to us. The terms of that channel are set out in the Vulnerability Disclosure Policy, and reports can be sent to [email protected].

7. Logging, Monitoring & Audit

Vexaro maintains logging and monitoring to support security, availability, and accountability.

• Audit logs. The Service records security-relevant events, such as authentication, session initiation, administrative actions, and policy changes, in audit logs. Audit-log availability to Customers depends on plan, and the applicable retention periods (for example, the Starter, Team, Business, and Enterprise tiers) are set out in the Privacy Notice.
• Operational monitoring. We monitor the health and performance of the Service with monitoring we operate ourselves, to detect, diagnose, and resolve faults. No third-party error-monitoring service is used today. Diagnostic data is handled as described in the Privacy Notice.
• Retention. Connection metadata, audit logs, and other operational records are retained for the periods stated in the Privacy Notice and then purged; we do not keep operational logs longer than the periods described there, except where retention is required by applicable mandatory rules.

8. Live Sessions & Recording

Live session media is encrypted in transit and is not stored by Vexaro. Between Vexaro apps the media is encrypted end-to-end, whether the devices connect directly (peer-to-peer) or through a relay because a direct connection is not possible: the two devices agree the keys of each session, no Vexaro component holds them, and a relay forwards data it cannot read. This needs version 0.2.13 or later of the Vexaro app on both devices; where one of them runs an older version, a relayed session is encrypted with a key the relay supplies and is not end-to-end encrypted against the relay. Browser-viewed sessions always use the relay, and the browser bridge opens their media on a Vexaro server to deliver it to the browser, without storing it (see the Encryption Overview). Vexaro does not store or inspect the content of live sessions, and the video of a Recording stays on the Customer’s computers.

Session recording is off unless the Customer turns it on. On the Team, Business, and Enterprise plans (including the Team trial), an owner or administrator of the Customer’s organisation can turn recording on in the administrative console and choose where the recording files are kept: on the computer that is accessed, on the operator’s computer, or on both. The operator’s computer keeps a copy only when the operator connects with the Vexaro Windows app and is a member of the Customer’s organisation; otherwise the computer that is accessed keeps the file. The files are written on those computers by the Vexaro Windows app (version 0.2.15 or later; older versions do not record) and are never uploaded to Vexaro. Vexaro stores only each Recording’s details (the session, the time, which computer keeps the file and where on it, its size and duration) and its event timeline, retained for the recording-retention period of the Customer’s plan; each time the Vexaro app finishes a recording on a computer, it deletes the recording files older than that period from its recordings folder there. From version 0.2.13 the app shows that a session will be, and is being, recorded. A Recording is Customer Content, and its details are accessible to the owners, administrators, and auditors of the Customer’s organisation. The Customer is responsible for notifying its End Users about remote access, monitoring, logging, and recording, and for having a lawful basis to do so.

Because of this design, Vexaro does not describe the Service as fully “zero-knowledge.” How live sessions and Recordings are treated for privacy and consent purposes is described in the Recording & Monitoring Notice and in the Privacy Notice.

9. Incident Response

Vexaro maintains an incident-response process to detect, assess, contain, and remediate security incidents, and to learn from them afterwards. The process assigns responsibilities, defines how incidents are triaged and escalated, and provides for evidence preservation and post-incident review.

If Vexaro confirms a security incident that affects Customer data, Vexaro will notify the affected Customer without undue delay after it confirms the incident, and within any period required by applicable mandatory rules, and will provide the information reasonably available about the incident and the measures taken or proposed in response. The corresponding contractual obligation, including what a Personal-Data Incident is and how notice is given, is set out in the Data Processing Addendum. Suspected security incidents and vulnerabilities can be reported to us at [email protected].

10. Shared Responsibility

Security of the Service is a shared responsibility. The division depends on whether the Service is operated by Vexaro (cloud) or by the Customer (Self-Hosted).

Vexaro is generally responsible for the security of the Vexaro-operated platform: the control plane (API, dashboard, signaling), managed connectivity (relay and failover), the encryption mechanisms described in Section 3, the security of the managed hosting, storage, and backup systems we operate, application security of the software we ship, and our personnel, processes, and monitoring.

The Customer is generally responsible for how it configures and uses the Service: managing its Authorized Users, roles, RBAC, MFA, and policies; safeguarding credentials, devices, and Agent deployments; deciding what data and Customer Content are transmitted or generated; choosing whether its plan includes session recording and which of its devices run the signed-in Vexaro app; obtaining authorisation for remote access and notifying End Users; and securing the Customer’s own networks and endpoints.

For a Self-Hosted Deployment, the Customer also operates and secures the underlying infrastructure that Vexaro would otherwise operate: hosting, network segmentation, operating systems, patching, backups, relay, secrets, and monitoring. The full split of responsibilities is set out in the Self-Hosted Responsibility Matrix.

11. Data Handling & Subprocessors

Vexaro Processes the categories of data described in the Privacy Notice for the purposes stated there, and engages third-party Subprocessors only for limited, defined functions: server and relay hosting, edge delivery and protection, payment processing, and email. Each Subprocessor is bound by contract to data-protection obligations equivalent in substance to ours. We notify Customers when we add or replace a Subprocessor, and the Customer can object.

The current Subprocessors, the Personal Data they receive, and the safeguards for processing outside the EEA are listed in the Subprocessor List. The contractual data-protection terms governing this Processing are in the Data Processing Addendum. Card payment data is handled by the applicable payment provider or Merchant of Record and is not stored by Vexaro.

12. Compliance Posture

Vexaro operates a privacy and security program designed for business use across multiple regions, and our information-security program is designed and operated to align with the principles of recognised information-security-management, service-organisation-control, and application-security-verification frameworks. Vexaro does not make a public claim of holding a third-party security certification unless that status is expressly confirmed in writing for the relevant period. We make security documentation available to business customers, under confidentiality, on request.

Business customers who require security and compliance documentation for their evaluation or vendor-management process may request the security materials we make available for that purpose, under confidentiality, and, where available, a third-party assessment or assurance report, by contacting [email protected]. The provision of any such material is for verification purposes only and is not a representation that Vexaro holds any particular certification or that any third-party assessment or assurance report exists at the time of the request; certification or assurance status, if any, is confirmed only in writing for the relevant period and scope. Compliance with applicable data-protection rules is addressed in the Privacy Notice and the Data Processing Addendum.

Contact

For security questions, vulnerability reports, and requests for security or compliance documentation (provided under confidentiality):

• Security reports / vulnerability disclosure: [email protected]
• Privacy / data-protection contact: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

---

This document is part of the Vexaro Legal Center.