Security
Security practices we actually run
This page describes controls visible in the current Vekra codebase and operations model. We do not claim SOC 2, ISO, or GDPR certification unless independently verified and stated here later.
Secrets stay on the server
API keys, admin credentials, webhook secrets, and signing keys are read from environment variables in server routes and modules — not shipped to the browser.
Session verification
User accounts use server-side password hashes (scrypt). Login ignores client-supplied plan and usage. Sessions use HMAC-signed tokens verified with a timing-safe comparison.
Admin access is separate
Admin sessions use a dedicated httpOnly signed cookie (SameSite=strict), requireAdmin checks, and Origin/Referer checks on mutating admin APIs.
Payment webhooks
Lahza webhook handling verifies provider signatures when configured and processes events idempotently so retries do not double-credit or double-charge.
Input validation
Request bodies and critical inputs are validated with schemas (Zod). Generative AI routes require a signed session; uploads are type/size checked; untrusted prompts are wrapped before model calls.
Rate limiting
Authentication, admin login, AI jobs, uploads, contact, checkout, and analytics ingest are rate-limited per IP or user to reduce abuse.
Billing integrity
Credits and plan entitlements are computed server-side. Usage is metered and associated with user and project/job where those entities exist. The client is not trusted for credit math.
Observability without prompt dumps
Job observability tracks provider, model, latency, credits, and success/failure. We avoid storing full sensitive prompt content when it is not required for the product.
What we do not claim here
- SOC 2 Type I/II certification
- ISO 27001 certification
- GDPR certification or DPA templates as a completed program
FAQ
Where do API keys live?
Server environment variables in route handlers and server modules — not the browser bundle.
Does Vekra claim SOC 2 or ISO 27001 here?
No. This page lists practices visible in the product today. Certifications will be named only if independently verified.
How are payments retried safely?
Webhooks verify signatures when configured and apply credit changes idempotently.