Security
How Vela stores, processes, and protects your company's brand data and campaign content.
All data stored in Supabase (PostgreSQL) is encrypted at rest using AES-256. All data transmitted between your browser and our servers is encrypted via TLS 1.3. Your repository data never travels unencrypted.
Your repository data and campaign library are backed up daily. We retain 14 days of backups on Team and Enterprise plans, 7 days on Solo. Backups are stored in a separate availability zone.
Every organization's data is logically isolated using Row Level Security (RLS) policies in PostgreSQL. No account can access another account's repository, campaigns, or settings — at the database level, not just the application layer.
Your brand guide, product documents, past campaigns, and repository data are never used to train any shared AI model. Your data is processed solely to generate campaigns for your account.
Database: Supabase (PostgreSQL) hosted on AWS infrastructure in us-east-1. SOC 2 Type II certified. ISO 27001 certified on Team and Enterprise plans.
Frontend hosting: Vercel (global CDN, DDoS protection, automatic HTTPS).
AI generation: Campaign generation calls go through an isolated API proxy. Your brand context is assembled server-side and never exposed in client-side code. Anthropic's Claude API is used for generation. Anthropic's usage policies prohibit training on API data.
File storage: Uploaded documents (brand guides, product docs) are stored in Supabase Storage (S3-backed), encrypted at rest, and accessible only to authenticated users within your organization.
If you discover a security vulnerability, please report it to security@getvela.io. We take all reports seriously and will respond within 24 hours. Please do not publicly disclose vulnerabilities before we've had a chance to address them.