Security

Where the data is

• Database, sign-in and files: Supabase, Ireland (European Union).
• Application and websites: Vercel, with functions running in Dublin, Ireland (European Union).
• Backups: on servers we operate ourselves, Prishtina, Kosovo.
• The full list of providers is in Annex III of the Data Processing Agreement.

How we protect it

• HTTPS on every page, for veturas.com, the dashboard and every dealership website.
• Each dealership's data is separated in the database with row-level security rules. One dealership cannot see another's data, even if the application has a bug.
• Vehicle documents are kept in private storage, not publicly accessible.
• Every user has their own account. There are no shared accounts.
• Support access is opened only for a recorded reason, is read-only, expires on its own within 24 hours and is logged. The dealership owner sees every access in the dashboard.
• The administration console has no public registration and is limited to the named team.
• Daily backups, kept for 30 days.
• We collect only the data the service needs. Data we do not hold cannot leak.
• Software dependencies and the platform are kept up to date.
• Incident response: assessment straight away and notice to the dealership within 48 hours.

Who holds which role

For buyer and customer data, the dealership is the controller and we are the processor. We act only on its instructions and help it meet its obligations. The details are in the Data Processing Agreement.

Reporting a vulnerability

If you have found a security issue, email info@veturas.com with the subject "Security". The same contact is published at /.well-known/security.txt.

In scope

veturas.com, app.veturas.com, admin.veturas.com and dealership websites on veturas.com addresses.

Out of scope

• Denial of service attacks or load testing.
• Social engineering, phishing or physical attacks.
• The systems of our providers. Report those to the provider directly.
• Automated scanner results without a demonstrated impact.
• Missing headers or best practices without a concrete risk.

What we ask of you

• Do not access, change or delete other people's data. If you reach it by accident, stop and tell us.
• Test only with your own accounts or on the demo website.
• Give us reasonable time to fix the issue before you make it public.
• Include enough detail for us to reproduce the issue.

What we commit to

• We acknowledge your report within 2 working days.
• We keep you updated at least every 14 days until it is fixed.
• With your permission, we credit you once it is fixed.
• We will not take legal action against research done in good faith within these rules.

We do not currently run a paid bug bounty programme.

If data is breached

We notify affected dealerships within 48 hours of becoming aware of it, so they can meet their 72-hour deadline towards the authority. For our own data we notify the authority within 72 hours and, where the risk is high, the affected people.

Do you have SOC 2 or ISO 27001?

No. We are a small team and do not claim certifications we do not hold. Our infrastructure providers hold their own certifications.

Do you run regular penetration tests?

Not on a schedule. We welcome reports under the rules above.

Will you sign our DPA?

Yes. Ours applies automatically with the Terms, and if you have your own we will review it and in most cases sign it.

Do you use our data to train AI?

No. Dealership and buyer data is not used to train artificial intelligence models.

Who at Veturas can see our data?

Only the named team, through support access that is time-limited, read-only and logged, and that you see in the dashboard.

What happens to our data if we leave?

You can export it at any time. After the account closes, the data stays available for 90 days so you can export it, then it is deleted.